Project - Autonomous Alert Investigation with AI Agents and Wazuh

1
#!/usr/bin/env python3
2
import json
3
import sys
4
import urllib.request
5
import urllib.error
6

7
# Wazuh passes:
8
# sys.argv[1] = alert file path
9
# sys.argv[2] = api_key (optional)
10
# sys.argv[3] = hook_url (optional)
11
alert_path = sys.argv[1] if len(sys.argv) > 1 else None
12
api_key = sys.argv[2] if len(sys.argv) > 2 else ""
13
hook_url = sys.argv[3] if len(sys.argv) > 3 else ""
14

15
if not alert_path or not hook_url:
16
    sys.exit(1)
17

18
with open(alert_path, "r", encoding="utf-8") as f:
19
    alert_json = json.load(f)
20

21
payload = {
22
    "source": "wazuh-integrator",
23
    "alert": alert_json
24
}
25

26
data = json.dumps(payload).encode("utf-8")
27

28
headers = {
29
    "Content-Type": "application/json"
30
}
31

32
if api_key:
33
    headers["X-API-Key"] = api_key
34

35
req = urllib.request.Request(
36
    hook_url,
37
    data=data,
38
    headers=headers,
39
    method="POST"
40
)
41

42
try:
43
    with urllib.request.urlopen(req, timeout=10) as response:
44
        # Read response so the request fully completes
45
        response.read()
46
except urllib.error.HTTPError as e:
47
    print(f"HTTPError: {e.code} {e.reason}")
48
    sys.exit(1)
49
except urllib.error.URLError as e:
50
    print(f"URLError: {e.reason}")
51
    sys.exit(1)
52
except Exception as e:
53
    print(f"Error: {e}")
54
    sys.exit(1)
55

56
sys.exit(0)

1
<integration>
2
  <name>custom-n8n</name>
3
  <hook_url>http://192.168.56.20:5678/webhook/wazuh-alert</hook_url>
4
  <rule_id>5715</rule_id>
5
  <alert_format>json</alert_format>
6
</integration>

1
<integration>
2
  <name>custom-n8n</name>
3
  <hook_url>http://192.168.56.20:5678/webhook/wazuh-alert</hook_url>
4
  <level>3</level>
5
  <alert_format>json</alert_format>
6
</integration>

1
You are a SOC analyst with experience in threat detection, triage, and incident response.
2

3
You will receive a single Wazuh SIEM alert in JSON format. Treat this alert as an initial signal only, not as conclusive evidence. Your task is to perform an initial triage assessment based on the alert contents and your SOC expertise.
4

5
Instructions:
6

7
1. Review the alert carefully and summarize, in clear and professional language, what activity or behavior it may indicate.
8
2. Do not make definitive claims unless the alert itself clearly supports them. Use cautious, evidence-based wording.
9
3. Assess whether the alert is suspicious enough to require further investigation.
10
4. If the alert alone is not sufficient for a confident assessment, provide specific follow-up investigation queries that another AI agent can run in OpenSearch.
11
5. Each investigation query must:
12
   - be written in simple logical form, not JSON
13
   - clearly state the data source or data type needed
14
   - specify exact filtering conditions
15
   - include a relevant timeframe
16
6. Rank the severity as one of: low, medium, high.
17
7. Return only valid JSON. Do not include markdown, explanations, or any text outside the JSON object.
18

19
Required output format:
20

21
{
22
"summary": "Brief professional summary of the observed or suspected behavior.",
23
"severity": "low|medium|high",
24
"investigate_further": true,
25
"why": "Reason this alert does or does not warrant further investigation.",
26
"next_questions": [
27
"1. <specific investigation query with data type, filters, and timeframe>",
28
"2. <specific investigation query with data type, filters, and timeframe>",
29
"3. <specific investigation query with data type, filters, and timeframe>"
30
]
31
}
32

33
Rules:
34

35
- If no additional investigation is needed, set "investigate_further" to false and return an empty array for "next_questions".
36
- Keep the summary concise but informative.
37
- Base your reasoning only on the provided alert and standard SOC analysis principles.
38
- Avoid speculation that is unsupported by the alert data.
39

40
Alert JSON:
41
{{ JSON.stringify($json.raw_alert || $json) }}

1
You are an AI Threat Hunter specializing in Wazuh alert validation and evidence-based investigation.
2

3
You will receive:
4

5
1. The original alert from Wazuh
6
2. The initial triage result
7

8
Your objective:
9
Determine whether the alert is benign, suspicious, likely a true positive, or inconclusive by verifying it against available indexed data.
10

11
Mandatory investigation workflow:
12
You must ALWAYS follow this exact order before making any conclusion:
13

14
1. Use ListIndexTool to identify the most relevant index
15
   - Prioritize indexes matching wazuh-alerts-\*
16
   - Choose the index whose time range is closest to the alert timestamp
17

18
2. Use IndexMappingTool on the selected index
19
   - Confirm that the fields needed for investigation actually exist
20
   - Do not assume or invent field names
21

22
3. Use SearchIndexTool only after confirming the field mappings
23
   - Build a valid query_dsl using only confirmed fields
24
   - Restrict searches to the time window closest to the alert
25
   - Do not run broad or unnecessary searches
26

27
Investigation rules:
28

29
- Prioritize precision over coverage
30
- Do not invent fields, values, or evidence
31
- If relevant data is unavailable, clearly state what data is missing
32
- Base your classification only on data returned by the tools, the alert, and the triage result
33
- If the available evidence is insufficient, return "inconclusive".
34
- Only use a conclusion as evidence if the tool has confirmed that the data source/index actually exists.
35
- If no suitable data source is available, state "data not available" instead of a negative conclusion.
36

37
Return ONLY valid JSON in this format:
38

39
{
40
"classification": "benign|suspicious|likely_true_positive|inconclusive",
41
"confidence": "low|medium|high",
42
"summary": "Concise evidence-based conclusion.",
43
"evidence": [
44
"Specific finding 1",
45
"Specific finding 2"
46
],
47
"queries_used": [
48
"ListIndexTool: ...",
49
"IndexMappingTool: ...",
50
"SearchIndexTool: ..."
51
],
52
"recommended_next_steps": [
53
"Next action 1",
54
"Next action 2"
55
]
56
}
57

58
Additional guidance:
59

60
- "benign" = evidence supports normal or expected activity
61
- "suspicious" = evidence suggests unusual behavior but is not conclusive
62
- "likely_true_positive" = evidence strongly supports malicious or policy-violating activity
63
- "inconclusive" = not enough data, missing fields, or insufficient search results
64

65
Alert:
66
{{ JSON.stringify($json.raw_alert || $json) }}
67

68
Triage:
69
{{ JSON.stringify($json.triage || {}) }}

1
{
2
  "summary": "Successful SSH authentication detected for user 'gun' from IP 192.168.56.20. This could indicate legitimate user activity or potential unauthorized access if the login is unexpected.",
3
  "severity": "medium",
4
  "investigate_further": true,
5
  "why": "The alert shows a valid SSH login, which is common but could be part of lateral movement or initial access if the source IP/user is unauthorized. No immediate evidence of exploitation, but context is needed.",
6
  "next_questions": [
7
    "Are there prior failed SSH login attempts for user 'gun' from 192.168.56.20 within 1 hour before this event? (Data type: Wazuh logs, filters: user=gun, srcip=192.168.56.20, event_type=authentication_failure)",
8
    "What actions did user 'gun' perform after this login? (Data type: Sysmon process creation logs, filters: user=gun, timeframe=10 minutes after 2026-03-19T14:33:37)",
9
    "Is 192.168.56.20 a whitelisted IP for SSH access to this host? (Data type: Network access policies, filters: srcip=192.168.56.20, service=SSH)"
10
  ]
11
}

1
{
2
  "classification": "suspicious",
3
  "confidence": "medium",
4
  "summary": "The successful SSH login lacks contextual validation from available data. No prior failed attempts or policy validation evidence was found.",
5
  "evidence": [
6
    "No prior failed SSH attempts for user 'gun' from 192.168.56.20 found in wazuh-alerts-2026.03.19 index",
7
    "No process creation logs for user 'gun' after 2026-03-19T14:33:37 found in sysmon-2026.03.19 index",
8
    "IP 192.168.56.20 not identified as whitelisted in network policies"
9
  ],
10
  "queries_used": [
11
    "ListIndexTool: index=\"wazuh-alerts-*\"",
12
    "IndexMappingTool: index=\"wazuh-alerts-2026.03.19\"",
13
    "SearchIndexTool: index=\"wazuh-alerts-2026.03.19\" query_dsl=\"{\\\"query\\\":{\\\"bool\\\":{\\\"must\\\":[{\\\"match\\\":{\\\"user\\\":\\\"gun\\\"}},{\\\"match\\\":{\\\"srcip\\\":\\\"192.168.56.20\\\"}},{\\\"range\\\":{\\\"timestamp\\\":{\\\"gte\\\":\\\"2026-03-19T08:33:37\\\",\\\"lte\\\":\\\"2026-03-19T14:33:37\\\"}}}]}}}\"",
14
    "SearchIndexTool: index=\"sysmon-2026.03.19\" query_dsl=\"{\\\"query\\\":{\\\"bool\\\":{\\\"must\\\":[{\\\"match\\\":{\\\"user\\\":\\\"gun\\\"}},{\\\"range\\\":{\\\"timestamp\\\":{\\\"gte\\\":\\\"2026-03-19T14:33:37\\\",\\\"lte\\\":\\\"2026-03-19T14:43:37\\\"}}}]}}}\""
15
  ],
16
  "recommended_next_steps": [
17
    "Verify IP 192.168.56.20 in network access control lists (ACLs) and firewall rules",
18
    "Correlate with other authentication logs (RADIUS, LDAP) for user 'gun' during this timeframe",
19
    "Check for privilege escalation attempts after this SSH session"
20
  ]
21
}