| 1 | from typing import Dict |
| 2 | from typing import List |
| 3 | |
| 4 | from app.integrations.copilot_mcp.schema.copilot_mcp import ExampleQuestion |
| 5 | from app.integrations.copilot_mcp.schema.copilot_mcp import MCPServerInfo |
| 6 | from app.integrations.copilot_mcp.schema.copilot_mcp import MCPServerType |
| 7 | |
| 8 | |
| 9 | class ExampleQuestionsService: |
| 10 | """Service for managing example questions for different MCP servers""" |
| 11 | |
| 12 | # Define example questions for each MCP server type |
| 13 | _EXAMPLE_QUESTIONS: Dict[MCPServerType, List[ExampleQuestion]] = { |
| 14 | MCPServerType.COPILOT: [ |
| 15 | ExampleQuestion( |
| 16 | question="How many alerts do I have for customerA?", |
| 17 | description="Get the total count of alerts for a specific customer", |
| 18 | category="alerts", |
| 19 | ), |
| 20 | ExampleQuestion( |
| 21 | question="What customer has the highest number of alerts?", |
| 22 | description="Find the customer with the most alerts in the system", |
| 23 | category="alerts", |
| 24 | ), |
| 25 | ExampleQuestion( |
| 26 | question="Show me spotted iocs for customerA", |
| 27 | description="Retrieve recent high-priority security alerts", |
| 28 | category="alerts", |
| 29 | ), |
| 30 | ExampleQuestion( |
| 31 | question="What are the top 5 most common alert sources?", |
| 32 | description="Analyze alert patterns to identify frequent security events", |
| 33 | category="analytics", |
| 34 | ), |
| 35 | ExampleQuestion( |
| 36 | question="How many active customers do we have?", |
| 37 | description="Get the count of currently active customers in the system", |
| 38 | category="customers", |
| 39 | ), |
| 40 | ExampleQuestion( |
| 41 | question="Show me agents status for customerA", |
| 42 | description="Display agents status.", |
| 43 | category="agents", |
| 44 | ), |
| 45 | ], |
| 46 | MCPServerType.WAZUH_MANAGER: [ |
| 47 | ExampleQuestion( |
| 48 | question="What is the status of agent endpoint123?", |
| 49 | description="Check the current operational status of a specific Wazuh agent", |
| 50 | category="agents", |
| 51 | ), |
| 52 | ExampleQuestion( |
| 53 | question="What are the SCA findings for endpoint123?", |
| 54 | description="Retrieve the Software Composition Analysis (SCA) findings for a specific endpoint", |
| 55 | category="agents", |
| 56 | ), |
| 57 | ExampleQuestion( |
| 58 | question="What are the open ports on endpoint123?", |
| 59 | description="List all open network ports detected on a specific endpoint", |
| 60 | category="network", |
| 61 | ), |
| 62 | ExampleQuestion( |
| 63 | question="What software is installed on endpoint123?", |
| 64 | description="Get inventory of installed software packages on an endpoint", |
| 65 | category="inventory", |
| 66 | ), |
| 67 | ExampleQuestion( |
| 68 | question="Show me all disconnected agents", |
| 69 | description="List agents that are currently offline or disconnected", |
| 70 | category="agents", |
| 71 | ), |
| 72 | ExampleQuestion( |
| 73 | question="Do I have any sysmon event 1 detection rules?", |
| 74 | description="Check for specific security rules related to Sysmon event 1", |
| 75 | category="rules", |
| 76 | ), |
| 77 | ], |
| 78 | MCPServerType.WAZUH_INDEXER: [ |
| 79 | ExampleQuestion( |
| 80 | question="What is the cluster health status?", |
| 81 | description="Check the overall health and status of the Wazuh indexer cluster", |
| 82 | category="health", |
| 83 | ), |
| 84 | ExampleQuestion( |
| 85 | question="What are the most critical vulnerabilities for `agent_name`: endpoint123 from the index pattern `wazuh-states-vulnerabilities-*`??", |
| 86 | description="Get critical vulnerabilities for a specific agent from the Wazuh index", |
| 87 | category="vulnerabilities", |
| 88 | ), |
| 89 | ExampleQuestion( |
| 90 | question="Has the agent named `agent_name` made any dns requests to `evil.com` within the index pattern `wazuh-customerA*`?", |
| 91 | description="Search for DNS requests made by a specific agent to a known malicious domain", |
| 92 | category="search", |
| 93 | ), |
| 94 | ExampleQuestion( |
| 95 | question="Has the agent named `agent_name` had any rule_group3 `authentication_failed` within the index name: `wazuh-customerA*`?", |
| 96 | description="Check for authentication failures in a specific index for a given agent", |
| 97 | category="search", |
| 98 | ), |
| 99 | ExampleQuestion( |
| 100 | question="How much diskspace is the `wazuh-customerA*` indices consuming?", |
| 101 | description="Get the disk space usage for all indices related to customerA", |
| 102 | category="indexing", |
| 103 | ), |
| 104 | ], |
| 105 | MCPServerType.VELOCIRAPTOR: [ |
| 106 | ExampleQuestion( |
| 107 | question="What users have logged onto endpoint123 in the last 30 days?", |
| 108 | description="List all users who have logged onto a specific endpoint within the last 30 days", |
| 109 | category="users", |
| 110 | ), |
| 111 | ExampleQuestion( |
| 112 | question="List all network connections on endpoint123", |
| 113 | description="Display active and recent network connections from an endpoint", |
| 114 | category="network", |
| 115 | ), |
| 116 | ExampleQuestion( |
| 117 | question="What artifacts are available for checking browser activity?", |
| 118 | description="Show available artifacts for browser activity analysis", |
| 119 | category="artifacts", |
| 120 | ), |
| 121 | ExampleQuestion( |
| 122 | question="What scheduled tasks exist on endpoint123?", |
| 123 | description="List all scheduled tasks for persistence analysis", |
| 124 | category="persistence", |
| 125 | ), |
| 126 | ExampleQuestion( |
| 127 | question="Find all executables in the Downloads folder across all endpoints", |
| 128 | description="Hunt for potentially suspicious executable files in user download directories", |
| 129 | category="hunting", |
| 130 | ), |
| 131 | ExampleQuestion( |
| 132 | question="Show me the startup programs on endpoint DESKTOP-ABC123", |
| 133 | description="List programs that start automatically with the system", |
| 134 | category="persistence", |
| 135 | ), |
| 136 | ExampleQuestion( |
| 137 | question="What browser artifacts can I collect from endpoint DESKTOP-ABC123?", |
| 138 | description="Gather web browser history, downloads, and other forensic artifacts", |
| 139 | category="artifacts", |
| 140 | ), |
| 141 | ], |
| 142 | MCPServerType.THREAT_INTEL: [ |
| 143 | ExampleQuestion( |
| 144 | question="What is the IP reputation for 8.8.8.8?", |
| 145 | description="Retrieve the IP reputation for a specific IP address", |
| 146 | category="threat_intel", |
| 147 | ), |
| 148 | ExampleQuestion( |
| 149 | question="What is the domain analysis for example.com?", |
| 150 | description="Get threat intelligence data for a specific domain", |
| 151 | category="threat_intel", |
| 152 | ), |
| 153 | ExampleQuestion( |
| 154 | question="What is the file hash analysis for 1234567890abcdef1234567890abcdef?", |
| 155 | description="Analyze a file hash for malware or other threats", |
| 156 | category="threat_intel", |
| 157 | ), |
| 158 | ], |
| 159 | MCPServerType.CYBER_NEWS: [ |
| 160 | ExampleQuestion( |
| 161 | question="What are the latest cyber threat headlines?", |
| 162 | description="Retrieve the most recent headlines related to cyber threats", |
| 163 | category="cyber_news", |
| 164 | ), |
| 165 | ExampleQuestion( |
| 166 | question="What vulnerabilities were disclosed this week?", |
| 167 | description="Get a list of vulnerabilities that were made public in the last week", |
| 168 | category="cyber_news", |
| 169 | ), |
| 170 | ExampleQuestion( |
| 171 | question="Who are the top threat actors currently?", |
| 172 | description="Identify the most active threat actors based on recent intelligence", |
| 173 | category="cyber_news", |
| 174 | ), |
| 175 | ], |
| 176 | MCPServerType.KNOWLEDGEBASE: [ |
| 177 | ExampleQuestion( |
| 178 | question="How would I configure the Office365 API Integration?", |
| 179 | description="Configure the Office365 API Integration for optimal performance", |
| 180 | category="knowledgebase", |
| 181 | ), |
| 182 | ExampleQuestion( |
| 183 | question="How can I create a new index set in Graylog?", |
| 184 | description="Get best practices for creating index sets in Graylog", |
| 185 | category="knowledgebase", |
| 186 | ), |
| 187 | ExampleQuestion( |
| 188 | question="How do I upgrade CoPilot?", |
| 189 | description="Follow these steps to upgrade your CoPilot installation", |
| 190 | category="knowledgebase", |
| 191 | ), |
| 192 | ], |
| 193 | MCPServerType.ATTACK_SURFACE: [ |
| 194 | ExampleQuestion( |
| 195 | question="Search for breaches related to email example@company.com", |
| 196 | description="Explore data breaches involving the specified email address", |
| 197 | category="attack_surface", |
| 198 | ), |
| 199 | ExampleQuestion( |
| 200 | question="Search for exposures regarding service.example.com", |
| 201 | description="Explore data exposures involving the specified service", |
| 202 | category="attack_surface", |
| 203 | ), |
| 204 | ExampleQuestion( |
| 205 | question="Has the password `password123` been exposed?", |
| 206 | description="Check if a specific password has been involved in any data breaches", |
| 207 | category="attack_surface", |
| 208 | ), |
| 209 | ], |
| 210 | } |
| 211 | |
| 212 | # Define server information with descriptions and capabilities |
| 213 | _SERVER_INFO: Dict[MCPServerType, MCPServerInfo] = { |
| 214 | MCPServerType.COPILOT: MCPServerInfo( |
| 215 | name="CoPilot", |
| 216 | value=MCPServerType.COPILOT.value, |
| 217 | description="Query customer data, alerts, incidents, and analytics from the CoPilot platform", |
| 218 | capabilities=[ |
| 219 | "Customer management queries", |
| 220 | "Alert analysis and filtering", |
| 221 | "Incident tracking and trends", |
| 222 | "Security analytics and reporting", |
| 223 | "Dashboard data retrieval", |
| 224 | ], |
| 225 | ), |
| 226 | MCPServerType.WAZUH_MANAGER: MCPServerInfo( |
| 227 | name="Wazuh Manager", |
| 228 | value=MCPServerType.WAZUH_MANAGER.value, |
| 229 | description="Interact with Wazuh Manager for agent management, security monitoring, and endpoint analysis", |
| 230 | capabilities=[ |
| 231 | "Agent status monitoring", |
| 232 | "Endpoint security scanning", |
| 233 | "Software inventory management", |
| 234 | "Network port analysis", |
| 235 | ], |
| 236 | ), |
| 237 | MCPServerType.WAZUH_INDEXER: MCPServerInfo( |
| 238 | name="Wazuh Indexer", |
| 239 | value=MCPServerType.WAZUH_INDEXER.value, |
| 240 | description="Query the Wazuh Indexer for log analysis, search operations, and cluster health monitoring", |
| 241 | capabilities=[ |
| 242 | "Log data search and analysis", |
| 243 | "Index management and statistics", |
| 244 | "Cluster health monitoring", |
| 245 | "Vulnerability assessment", |
| 246 | ], |
| 247 | ), |
| 248 | MCPServerType.VELOCIRAPTOR: MCPServerInfo( |
| 249 | name="Velociraptor", |
| 250 | value=MCPServerType.VELOCIRAPTOR.value, |
| 251 | description="Digital forensics and incident response platform for endpoint monitoring and threat hunting", |
| 252 | capabilities=[ |
| 253 | "Live endpoint forensics", |
| 254 | "Artifact collection and analysis", |
| 255 | "Process and network monitoring", |
| 256 | "Persistence mechanism detection", |
| 257 | "Lateral movement hunting", |
| 258 | "Browser artifact collection", |
| 259 | "Hardware device tracking", |
| 260 | ], |
| 261 | ), |
| 262 | MCPServerType.THREAT_INTEL: MCPServerInfo( |
| 263 | name="Threat Intel", |
| 264 | value=MCPServerType.THREAT_INTEL.value, |
| 265 | description="Access threat intelligence data, such as IP reputation scores and malware indicators", |
| 266 | capabilities=[ |
| 267 | "Threat intelligence lookups", |
| 268 | "IP and domain reputation scoring", |
| 269 | "File hash and URL analysis", |
| 270 | ], |
| 271 | ), |
| 272 | MCPServerType.CYBER_NEWS: MCPServerInfo( |
| 273 | name="Cyber News", |
| 274 | value=MCPServerType.CYBER_NEWS.value, |
| 275 | description="Access the latest news and updates related to cyber threats and vulnerabilities", |
| 276 | capabilities=[ |
| 277 | "Vulnerability disclosure tracking", |
| 278 | ], |
| 279 | ), |
| 280 | MCPServerType.KNOWLEDGEBASE: MCPServerInfo( |
| 281 | name="Knowledgebase", |
| 282 | value=MCPServerType.KNOWLEDGEBASE.value, |
| 283 | description="Access documentation and guides for using CoPilot and its integrations", |
| 284 | capabilities=[ |
| 285 | "Configuration guides", |
| 286 | "Best practices", |
| 287 | "Troubleshooting tips", |
| 288 | ], |
| 289 | ), |
| 290 | MCPServerType.ATTACK_SURFACE: MCPServerInfo( |
| 291 | name="Attack Surface", |
| 292 | value=MCPServerType.ATTACK_SURFACE.value, |
| 293 | description="Analyze and manage the attack surface of your organization", |
| 294 | capabilities=[ |
| 295 | "Attack surface mapping", |
| 296 | "Exposure management", |
| 297 | "Risk assessment", |
| 298 | ], |
| 299 | ), |
| 300 | } |
| 301 | |
| 302 | @classmethod |
| 303 | def get_example_questions(cls, mcp_server: MCPServerType) -> List[ExampleQuestion]: |
| 304 | """ |
| 305 | Get example questions for a specific MCP server type. |
| 306 | |
| 307 | Args: |
| 308 | mcp_server: The MCP server type to get questions for |
| 309 | |
| 310 | Returns: |
| 311 | List of example questions for the specified server |
| 312 | """ |
| 313 | return cls._EXAMPLE_QUESTIONS.get(mcp_server, []) |
| 314 | |
| 315 | @classmethod |
| 316 | def get_questions_by_category(cls, mcp_server: MCPServerType, category: str) -> List[ExampleQuestion]: |
| 317 | """ |
| 318 | Get example questions for a specific MCP server type filtered by category. |
| 319 | |
| 320 | Args: |
| 321 | mcp_server: The MCP server type to get questions for |
| 322 | category: The category to filter by |
| 323 | |
| 324 | Returns: |
| 325 | List of example questions filtered by category |
| 326 | """ |
| 327 | all_questions = cls.get_example_questions(mcp_server) |
| 328 | return [q for q in all_questions if q.category == category] |
| 329 | |
| 330 | @classmethod |
| 331 | def get_available_categories(cls, mcp_server: MCPServerType) -> List[str]: |
| 332 | """ |
| 333 | Get available categories for a specific MCP server type. |
| 334 | |
| 335 | Args: |
| 336 | mcp_server: The MCP server type to get categories for |
| 337 | |
| 338 | Returns: |
| 339 | List of unique categories available for the server |
| 340 | """ |
| 341 | questions = cls.get_example_questions(mcp_server) |
| 342 | categories = {q.category for q in questions if q.category} |
| 343 | return sorted(list(categories)) |
| 344 | |
| 345 | @classmethod |
| 346 | def add_example_question(cls, mcp_server: MCPServerType, question: ExampleQuestion) -> None: |
| 347 | """ |
| 348 | Add a new example question to a specific MCP server type. |
| 349 | |
| 350 | Args: |
| 351 | mcp_server: The MCP server type to add the question to |
| 352 | question: The example question to add |
| 353 | """ |
| 354 | if mcp_server not in cls._EXAMPLE_QUESTIONS: |
| 355 | cls._EXAMPLE_QUESTIONS[mcp_server] = [] |
| 356 | cls._EXAMPLE_QUESTIONS[mcp_server].append(question) |
| 357 | |
| 358 | @classmethod |
| 359 | def get_available_servers(cls) -> List[MCPServerInfo]: |
| 360 | """ |
| 361 | Get information about all available MCP servers. |
| 362 | |
| 363 | Returns: |
| 364 | List of MCPServerInfo objects containing server details |
| 365 | """ |
| 366 | return list(cls._SERVER_INFO.values()) |
| 367 | |
| 368 | @classmethod |
| 369 | def get_server_info(cls, mcp_server: MCPServerType) -> MCPServerInfo: |
| 370 | """ |
| 371 | Get detailed information about a specific MCP server. |
| 372 | |
| 373 | Args: |
| 374 | mcp_server: The MCP server type to get information for |
| 375 | |
| 376 | Returns: |
| 377 | MCPServerInfo object with server details |
| 378 | """ |
| 379 | return cls._SERVER_INFO.get(mcp_server) |