Add 04_agent_intelligence.ipynb

notebooks/04_agent_intelligence.ipynb

@@ -0,0 +1,773 @@
+{
+ "cells": [
+  {
+   "cell_type": "markdown",
+   "id": "a684408b",
+   "metadata": {},
+   "source": [
+    "# 04 - Agent Intelligence\n",
+    "\n",
+    "## CyberForge AI - Agentic AI Capabilities\n",
+    "\n",
+    "This notebook implements intelligent agent decision-making for:\n",
+    "- Task prioritization and execution planning\n",
+    "- Confidence-based decision scoring\n",
+    "- Gemini API integration for reasoning\n",
+    "- Autonomous threat response workflows\n",
+    "\n",
+    "### Alignment:\n",
+    "- Integrates with desktop app agentic system\n",
+    "- Supports backend task queue management\n",
+    "- Provides explainable outputs for user transparency"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "id": "8af0eaa6",
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "import json\n",
+    "import os\n",
+    "import time\n",
+    "import numpy as np\n",
+    "from pathlib import Path\n",
+    "from typing import Dict, List, Any, Optional, Tuple\n",
+    "from dataclasses import dataclass, asdict\n",
+    "from enum import Enum\n",
+    "import warnings\n",
+    "warnings.filterwarnings('ignore')\n",
+    "\n",
+    "# Load configuration\n",
+    "config_path = Path(\"../notebook_config.json\")\n",
+    "with open(config_path) as f:\n",
+    "    CONFIG = json.load(f)\n",
+    "\n",
+    "MODELS_DIR = Path(CONFIG[\"datasets_dir\"]).parent / \"models\"\n",
+    "AGENT_DIR = MODELS_DIR.parent / \"agent\"\n",
+    "AGENT_DIR.mkdir(exist_ok=True)\n",
+    "\n",
+    "print(f\"✓ Configuration loaded\")\n",
+    "print(f\"✓ Agent output: {AGENT_DIR}\")"
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "id": "bbcc7dc9",
+   "metadata": {},
+   "source": [
+    "## 1. Agent Task Definitions"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "id": "bc6eb821",
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "class TaskPriority(Enum):\n",
+    "    CRITICAL = 4\n",
+    "    HIGH = 3\n",
+    "    MEDIUM = 2\n",
+    "    LOW = 1\n",
+    "    BACKGROUND = 0\n",
+    "\n",
+    "@dataclass\n",
+    "class AgentTask:\n",
+    "    \"\"\"Represents a task the agent can execute\"\"\"\n",
+    "    task_id: str\n",
+    "    task_type: str\n",
+    "    priority: int\n",
+    "    target: str\n",
+    "    context: Dict\n",
+    "    created_at: float\n",
+    "    confidence: float = 0.0\n",
+    "    status: str = \"pending\"\n",
+    "    result: Dict = None\n",
+    "    \n",
+    "    def to_dict(self) -> Dict:\n",
+    "        return asdict(self)\n",
+    "\n",
+    "@dataclass\n",
+    "class AgentDecision:\n",
+    "    \"\"\"Represents an agent decision with reasoning\"\"\"\n",
+    "    action: str\n",
+    "    confidence: float\n",
+    "    reasoning: str\n",
+    "    evidence: List[str]\n",
+    "    risk_level: str\n",
+    "    recommended_follow_up: List[str]\n",
+    "    \n",
+    "    def to_dict(self) -> Dict:\n",
+    "        return asdict(self)\n",
+    "\n",
+    "print(\"✓ Task definitions loaded\")"
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "id": "c6785168",
+   "metadata": {},
+   "source": [
+    "## 2. Decision Scoring Engine"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "id": "0e0109ae",
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "class DecisionScoringEngine:\n",
+    "    \"\"\"\n",
+    "    Calculates confidence scores for agent decisions.\n",
+    "    Combines model predictions with heuristic rules.\n",
+    "    \"\"\"\n",
+    "    \n",
+    "    # Threat severity weights\n",
+    "    SEVERITY_WEIGHTS = {\n",
+    "        'critical': 1.0,\n",
+    "        'high': 0.8,\n",
+    "        'medium': 0.5,\n",
+    "        'low': 0.3,\n",
+    "        'info': 0.1\n",
+    "    }\n",
+    "    \n",
+    "    # Evidence type weights\n",
+    "    EVIDENCE_WEIGHTS = {\n",
+    "        'model_prediction': 0.4,\n",
+    "        'signature_match': 0.3,\n",
+    "        'behavioral_pattern': 0.2,\n",
+    "        'heuristic_rule': 0.1\n",
+    "    }\n",
+    "    \n",
+    "    def __init__(self, confidence_threshold: float = 0.7):\n",
+    "        self.confidence_threshold = confidence_threshold\n",
+    "    \n",
+    "    def calculate_threat_score(self, indicators: List[Dict]) -> Tuple[float, str]:\n",
+    "        \"\"\"Calculate threat score from multiple indicators\"\"\"\n",
+    "        if not indicators:\n",
+    "            return 0.0, 'low'\n",
+    "        \n",
+    "        # Weighted average of indicator scores\n",
+    "        total_weight = 0\n",
+    "        total_score = 0\n",
+    "        \n",
+    "        for indicator in indicators:\n",
+    "            severity = indicator.get('severity', 'low')\n",
+    "            confidence = indicator.get('confidence', 0.5)\n",
+    "            evidence_type = indicator.get('evidence_type', 'heuristic_rule')\n",
+    "            \n",
+    "            weight = self.SEVERITY_WEIGHTS.get(severity, 0.3) * \\\n",
+    "                     self.EVIDENCE_WEIGHTS.get(evidence_type, 0.1)\n",
+    "            \n",
+    "            total_weight += weight\n",
+    "            total_score += confidence * weight\n",
+    "        \n",
+    "        if total_weight == 0:\n",
+    "            return 0.0, 'low'\n",
+    "        \n",
+    "        final_score = total_score / total_weight\n",
+    "        \n",
+    "        # Determine risk level\n",
+    "        if final_score >= 0.8:\n",
+    "            risk = 'critical'\n",
+    "        elif final_score >= 0.6:\n",
+    "            risk = 'high'\n",
+    "        elif final_score >= 0.4:\n",
+    "            risk = 'medium'\n",
+    "        elif final_score >= 0.2:\n",
+    "            risk = 'low'\n",
+    "        else:\n",
+    "            risk = 'info'\n",
+    "        \n",
+    "        return final_score, risk\n",
+    "    \n",
+    "    def should_act(self, score: float, task_type: str) -> bool:\n",
+    "        \"\"\"Determine if agent should act based on score\"\"\"\n",
+    "        # Different thresholds for different task types\n",
+    "        thresholds = {\n",
+    "            'block_threat': 0.85,\n",
+    "            'quarantine': 0.75,\n",
+    "            'alert': 0.5,\n",
+    "            'scan': 0.3,\n",
+    "            'monitor': 0.1\n",
+    "        }\n",
+    "        \n",
+    "        threshold = thresholds.get(task_type, self.confidence_threshold)\n",
+    "        return score >= threshold\n",
+    "    \n",
+    "    def prioritize_tasks(self, tasks: List[AgentTask]) -> List[AgentTask]:\n",
+    "        \"\"\"Sort tasks by priority and confidence\"\"\"\n",
+    "        return sorted(tasks, \n",
+    "                      key=lambda t: (t.priority, t.confidence), \n",
+    "                      reverse=True)\n",
+    "\n",
+    "scoring_engine = DecisionScoringEngine()\n",
+    "print(\"✓ Decision Scoring Engine initialized\")"
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "id": "572652b4",
+   "metadata": {},
+   "source": [
+    "## 3. Gemini API Integration for Reasoning"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "id": "e68b585e",
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "try:\n",
+    "    import google.generativeai as genai\n",
+    "    GEMINI_AVAILABLE = True\n",
+    "except ImportError:\n",
+    "    import subprocess\n",
+    "    subprocess.run(['pip', 'install', 'google-generativeai', '-q'])\n",
+    "    import google.generativeai as genai\n",
+    "    GEMINI_AVAILABLE = True\n",
+    "\n",
+    "class GeminiReasoningEngine:\n",
+    "    \"\"\"\n",
+    "    Uses Gemini API for intelligent threat reasoning.\n",
+    "    Provides explainable AI outputs.\n",
+    "    \"\"\"\n",
+    "    \n",
+    "    SYSTEM_PROMPT = \"\"\"You are a cybersecurity AI agent analyzing security threats.\n",
+    "Your role is to:\n",
+    "1. Analyze security indicators and threat patterns\n",
+    "2. Provide clear, actionable recommendations\n",
+    "3. Explain your reasoning in a way users can understand\n",
+    "4. Prioritize user safety while minimizing false positives\n",
+    "\n",
+    "Always respond with JSON containing:\n",
+    "- action: recommended action (block, alert, monitor, allow)\n",
+    "- confidence: 0.0-1.0 confidence score\n",
+    "- reasoning: brief explanation\n",
+    "- evidence: list of supporting evidence\n",
+    "- risk_level: critical/high/medium/low/info\n",
+    "- recommended_follow_up: list of next steps\"\"\"\n",
+    "    \n",
+    "    def __init__(self):\n",
+    "        self.api_key = CONFIG.get('gemini_api_key', os.environ.get('GEMINI_API_KEY'))\n",
+    "        self.model = None\n",
+    "        \n",
+    "        if self.api_key:\n",
+    "            try:\n",
+    "                genai.configure(api_key=self.api_key)\n",
+    "                self.model = genai.GenerativeModel('gemini-2.0-flash')\n",
+    "                print(\"  ✓ Gemini API connected\")\n",
+    "            except Exception as e:\n",
+    "                print(f\"  ⚠ Gemini API error: {e}\")\n",
+    "        else:\n",
+    "            print(\"  ⚠ No Gemini API key found (will use fallback reasoning)\")\n",
+    "    \n",
+    "    def analyze_threat(self, threat_data: Dict) -> AgentDecision:\n",
+    "        \"\"\"Analyze threat and generate decision with reasoning\"\"\"\n",
+    "        if self.model:\n",
+    "            return self._gemini_analyze(threat_data)\n",
+    "        else:\n",
+    "            return self._fallback_analyze(threat_data)\n",
+    "    \n",
+    "    def _gemini_analyze(self, threat_data: Dict) -> AgentDecision:\n",
+    "        \"\"\"Use Gemini for threat analysis\"\"\"\n",
+    "        prompt = f\"\"\"{self.SYSTEM_PROMPT}\n",
+    "\n",
+    "Analyze this security threat:\n",
+    "{json.dumps(threat_data, indent=2)}\n",
+    "\n",
+    "Provide your analysis as JSON.\"\"\"\n",
+    "        \n",
+    "        try:\n",
+    "            response = self.model.generate_content(prompt)\n",
+    "            \n",
+    "            # Parse response\n",
+    "            text = response.text\n",
+    "            # Extract JSON from response\n",
+    "            if '```json' in text:\n",
+    "                text = text.split('```json')[1].split('```')[0]\n",
+    "            elif '```' in text:\n",
+    "                text = text.split('```')[1].split('```')[0]\n",
+    "            \n",
+    "            result = json.loads(text)\n",
+    "            \n",
+    "            return AgentDecision(\n",
+    "                action=result.get('action', 'monitor'),\n",
+    "                confidence=float(result.get('confidence', 0.5)),\n",
+    "                reasoning=result.get('reasoning', 'Analysis pending'),\n",
+    "                evidence=result.get('evidence', []),\n",
+    "                risk_level=result.get('risk_level', 'medium'),\n",
+    "                recommended_follow_up=result.get('recommended_follow_up', [])\n",
+    "            )\n",
+    "        except Exception as e:\n",
+    "            print(f\"  ⚠ Gemini error: {e}\")\n",
+    "            return self._fallback_analyze(threat_data)\n",
+    "    \n",
+    "    def _fallback_analyze(self, threat_data: Dict) -> AgentDecision:\n",
+    "        \"\"\"Rule-based fallback when Gemini unavailable\"\"\"\n",
+    "        risk_score = threat_data.get('risk_score', 0.5)\n",
+    "        indicators = threat_data.get('indicators', [])\n",
+    "        \n",
+    "        # Determine action based on risk score\n",
+    "        if risk_score >= 0.8:\n",
+    "            action = 'block'\n",
+    "            risk_level = 'critical'\n",
+    "        elif risk_score >= 0.6:\n",
+    "            action = 'alert'\n",
+    "            risk_level = 'high'\n",
+    "        elif risk_score >= 0.4:\n",
+    "            action = 'monitor'\n",
+    "            risk_level = 'medium'\n",
+    "        else:\n",
+    "            action = 'allow'\n",
+    "            risk_level = 'low'\n",
+    "        \n",
+    "        return AgentDecision(\n",
+    "            action=action,\n",
+    "            confidence=risk_score,\n",
+    "            reasoning=f\"Risk score: {risk_score:.2f}. Indicators found: {len(indicators)}\",\n",
+    "            evidence=[str(i) for i in indicators[:3]],\n",
+    "            risk_level=risk_level,\n",
+    "            recommended_follow_up=['Continue monitoring', 'Review threat logs']\n",
+    "        )\n",
+    "\n",
+    "reasoning_engine = GeminiReasoningEngine()\n",
+    "print(\"✓ Gemini Reasoning Engine initialized\")"
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "id": "a5f5a0a7",
+   "metadata": {},
+   "source": [
+    "## 4. Task Queue Manager"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "id": "1f9ba4fe",
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "import uuid\n",
+    "from collections import deque\n",
+    "\n",
+    "class AgentTaskQueue:\n",
+    "    \"\"\"\n",
+    "    Manages agent task queue for autonomous operation.\n",
+    "    Supports priority-based execution and task lifecycle.\n",
+    "    \"\"\"\n",
+    "    \n",
+    "    def __init__(self, max_concurrent: int = 5):\n",
+    "        self.pending = deque()\n",
+    "        self.active = []\n",
+    "        self.completed = []\n",
+    "        self.failed = []\n",
+    "        self.max_concurrent = max_concurrent\n",
+    "    \n",
+    "    def add_task(self, task_type: str, target: str, context: Dict,\n",
+    "                 priority: TaskPriority = TaskPriority.MEDIUM) -> AgentTask:\n",
+    "        \"\"\"Add a new task to the queue\"\"\"\n",
+    "        task = AgentTask(\n",
+    "            task_id=str(uuid.uuid4())[:8],\n",
+    "            task_type=task_type,\n",
+    "            priority=priority.value,\n",
+    "            target=target,\n",
+    "            context=context,\n",
+    "            created_at=time.time()\n",
+    "        )\n",
+    "        \n",
+    "        self.pending.append(task)\n",
+    "        self._reorder_queue()\n",
+    "        \n",
+    "        return task\n",
+    "    \n",
+    "    def _reorder_queue(self):\n",
+    "        \"\"\"Reorder queue by priority\"\"\"\n",
+    "        self.pending = deque(sorted(self.pending, \n",
+    "                                    key=lambda t: (t.priority, -t.created_at),\n",
+    "                                    reverse=True))\n",
+    "    \n",
+    "    def get_next_task(self) -> Optional[AgentTask]:\n",
+    "        \"\"\"Get next task to execute\"\"\"\n",
+    "        if len(self.active) >= self.max_concurrent:\n",
+    "            return None\n",
+    "        \n",
+    "        if self.pending:\n",
+    "            task = self.pending.popleft()\n",
+    "            task.status = 'active'\n",
+    "            self.active.append(task)\n",
+    "            return task\n",
+    "        \n",
+    "        return None\n",
+    "    \n",
+    "    def complete_task(self, task_id: str, result: Dict, success: bool = True):\n",
+    "        \"\"\"Mark task as completed\"\"\"\n",
+    "        for i, task in enumerate(self.active):\n",
+    "            if task.task_id == task_id:\n",
+    "                task.status = 'completed' if success else 'failed'\n",
+    "                task.result = result\n",
+    "                \n",
+    "                if success:\n",
+    "                    self.completed.append(task)\n",
+    "                else:\n",
+    "                    self.failed.append(task)\n",
+    "                \n",
+    "                del self.active[i]\n",
+    "                return\n",
+    "    \n",
+    "    def get_stats(self) -> Dict:\n",
+    "        \"\"\"Get queue statistics\"\"\"\n",
+    "        return {\n",
+    "            'pending': len(self.pending),\n",
+    "            'active': len(self.active),\n",
+    "            'completed': len(self.completed),\n",
+    "            'failed': len(self.failed),\n",
+    "            'total': len(self.pending) + len(self.active) + len(self.completed) + len(self.failed)\n",
+    "        }\n",
+    "\n",
+    "task_queue = AgentTaskQueue()\n",
+    "print(\"✓ Task Queue Manager initialized\")"
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "id": "1a56cbf3",
+   "metadata": {},
+   "source": [
+    "## 5. Autonomous Agent Orchestrator"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "id": "3a79fff8",
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "class CyberForgeAgent:\n",
+    "    \"\"\"\n",
+    "    Main autonomous agent for CyberForge.\n",
+    "    Orchestrates threat detection, analysis, and response.\n",
+    "    \"\"\"\n",
+    "    \n",
+    "    def __init__(self):\n",
+    "        self.scoring_engine = DecisionScoringEngine()\n",
+    "        self.reasoning_engine = GeminiReasoningEngine()\n",
+    "        self.task_queue = AgentTaskQueue()\n",
+    "        self.action_history = []\n",
+    "    \n",
+    "    def analyze_website(self, url: str, scraped_data: Dict) -> AgentDecision:\n",
+    "        \"\"\"Analyze a website for threats\"\"\"\n",
+    "        # Extract indicators\n",
+    "        indicators = self._extract_indicators(scraped_data)\n",
+    "        \n",
+    "        # Calculate threat score\n",
+    "        score, risk_level = self.scoring_engine.calculate_threat_score(indicators)\n",
+    "        \n",
+    "        # Get AI reasoning\n",
+    "        threat_data = {\n",
+    "            'url': url,\n",
+    "            'risk_score': score,\n",
+    "            'indicators': indicators,\n",
+    "            'security_report': scraped_data.get('security_report', {})\n",
+    "        }\n",
+    "        \n",
+    "        decision = self.reasoning_engine.analyze_threat(threat_data)\n",
+    "        \n",
+    "        # Log decision\n",
+    "        self._log_action(url, decision)\n",
+    "        \n",
+    "        return decision\n",
+    "    \n",
+    "    def _extract_indicators(self, data: Dict) -> List[Dict]:\n",
+    "        \"\"\"Extract threat indicators from scraped data\"\"\"\n",
+    "        indicators = []\n",
+    "        \n",
+    "        # Check security report\n",
+    "        security = data.get('security_report', {})\n",
+    "        if not security.get('is_https', True):\n",
+    "            indicators.append({\n",
+    "                'type': 'insecure_protocol',\n",
+    "                'severity': 'medium',\n",
+    "                'confidence': 0.9,\n",
+    "                'evidence_type': 'signature_match'\n",
+    "            })\n",
+    "        \n",
+    "        if security.get('mixed_content', False):\n",
+    "            indicators.append({\n",
+    "                'type': 'mixed_content',\n",
+    "                'severity': 'medium',\n",
+    "                'confidence': 0.85,\n",
+    "                'evidence_type': 'signature_match'\n",
+    "            })\n",
+    "        \n",
+    "        # Check console errors\n",
+    "        console_logs = data.get('console_logs', [])\n",
+    "        errors = [log for log in console_logs if log.get('level') == 'error']\n",
+    "        if len(errors) > 5:\n",
+    "            indicators.append({\n",
+    "                'type': 'excessive_errors',\n",
+    "                'severity': 'low',\n",
+    "                'confidence': 0.6,\n",
+    "                'evidence_type': 'behavioral_pattern'\n",
+    "            })\n",
+    "        \n",
+    "        # Check for suspicious network requests\n",
+    "        requests = data.get('network_requests', [])\n",
+    "        suspicious_domains = ['malware', 'phishing', 'hack', 'tracker']\n",
+    "        for req in requests:\n",
+    "            url = req.get('url', '').lower()\n",
+    "            if any(s in url for s in suspicious_domains):\n",
+    "                indicators.append({\n",
+    "                    'type': 'suspicious_request',\n",
+    "                    'severity': 'high',\n",
+    "                    'confidence': 0.75,\n",
+    "                    'evidence_type': 'signature_match',\n",
+    "                    'details': url[:100]\n",
+    "                })\n",
+    "        \n",
+    "        return indicators\n",
+    "    \n",
+    "    def _log_action(self, target: str, decision: AgentDecision):\n",
+    "        \"\"\"Log agent action for audit trail\"\"\"\n",
+    "        self.action_history.append({\n",
+    "            'timestamp': time.time(),\n",
+    "            'target': target,\n",
+    "            'action': decision.action,\n",
+    "            'confidence': decision.confidence,\n",
+    "            'risk_level': decision.risk_level\n",
+    "        })\n",
+    "    \n",
+    "    def get_action_summary(self) -> Dict:\n",
+    "        \"\"\"Get summary of agent actions\"\"\"\n",
+    "        if not self.action_history:\n",
+    "            return {'total_actions': 0}\n",
+    "        \n",
+    "        actions = [a['action'] for a in self.action_history]\n",
+    "        return {\n",
+    "            'total_actions': len(self.action_history),\n",
+    "            'action_counts': {a: actions.count(a) for a in set(actions)},\n",
+    "            'avg_confidence': np.mean([a['confidence'] for a in self.action_history])\n",
+    "        }\n",
+    "\n",
+    "agent = CyberForgeAgent()\n",
+    "print(\"✓ CyberForge Agent initialized\")"
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "id": "7b7ad27d",
+   "metadata": {},
+   "source": [
+    "## 6. Test Agent Decision Making"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "id": "a377b332",
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "# Test with sample threat data\n",
+    "test_data = {\n",
+    "    'url': 'https://suspicious-login.example.com/verify',\n",
+    "    'security_report': {\n",
+    "        'is_https': True,\n",
+    "        'mixed_content': True,\n",
+    "        'insecure_cookies': True\n",
+    "    },\n",
+    "    'console_logs': [\n",
+    "        {'level': 'error', 'message': 'CORS policy violation'},\n",
+    "        {'level': 'error', 'message': 'Failed to load resource'},\n",
+    "    ],\n",
+    "    'network_requests': [\n",
+    "        {'url': 'https://tracker.malicious.com/collect', 'type': 'xhr'},\n",
+    "        {'url': 'https://cdn.example.com/app.js', 'type': 'script'}\n",
+    "    ]\n",
+    "}\n",
+    "\n",
+    "print(\"Testing agent analysis...\\n\")\n",
+    "decision = agent.analyze_website(test_data['url'], test_data)\n",
+    "\n",
+    "print(f\"Decision: {decision.action}\")\n",
+    "print(f\"Confidence: {decision.confidence:.2%}\")\n",
+    "print(f\"Risk Level: {decision.risk_level}\")\n",
+    "print(f\"\\nReasoning: {decision.reasoning}\")\n",
+    "print(f\"\\nEvidence:\")\n",
+    "for e in decision.evidence[:3]:\n",
+    "    print(f\"  - {e}\")\n",
+    "print(f\"\\nRecommended Follow-up:\")\n",
+    "for r in decision.recommended_follow_up[:3]:\n",
+    "    print(f\"  - {r}\")"
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "id": "e68ef74b",
+   "metadata": {},
+   "source": [
+    "## 7. Save Agent Configuration"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "id": "cde8619f",
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "# Save agent configuration and modules\n",
+    "agent_config = {\n",
+    "    'version': '1.0.0',\n",
+    "    'confidence_threshold': 0.7,\n",
+    "    'max_concurrent_tasks': 5,\n",
+    "    'severity_weights': DecisionScoringEngine.SEVERITY_WEIGHTS,\n",
+    "    'evidence_weights': DecisionScoringEngine.EVIDENCE_WEIGHTS,\n",
+    "    'task_priorities': {p.name: p.value for p in TaskPriority},\n",
+    "    'gemini_model': 'gemini-2.0-flash'\n",
+    "}\n",
+    "\n",
+    "config_path = AGENT_DIR / \"agent_config.json\"\n",
+    "with open(config_path, 'w') as f:\n",
+    "    json.dump(agent_config, f, indent=2)\n",
+    "\n",
+    "print(f\"✓ Agent config saved to: {config_path}\")"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "id": "43b960cd",
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "# Save agent module for backend import\n",
+    "agent_module = '''\n",
+    "\"\"\"CyberForge Agent Intelligence Module\"\"\"\n",
+    "\n",
+    "import json\n",
+    "import time\n",
+    "import numpy as np\n",
+    "from pathlib import Path\n",
+    "from dataclasses import dataclass, asdict\n",
+    "from typing import Dict, List, Any, Optional\n",
+    "\n",
+    "@dataclass\n",
+    "class AgentDecision:\n",
+    "    action: str\n",
+    "    confidence: float\n",
+    "    reasoning: str\n",
+    "    evidence: List[str]\n",
+    "    risk_level: str\n",
+    "    recommended_follow_up: List[str]\n",
+    "    \n",
+    "    def to_dict(self):\n",
+    "        return asdict(self)\n",
+    "\n",
+    "class DecisionEngine:\n",
+    "    SEVERITY_WEIGHTS = {\"critical\": 1.0, \"high\": 0.8, \"medium\": 0.5, \"low\": 0.3, \"info\": 0.1}\n",
+    "    \n",
+    "    def calculate_threat_score(self, indicators: List[Dict]) -> tuple:\n",
+    "        if not indicators:\n",
+    "            return 0.0, \"low\"\n",
+    "        scores = [i.get(\"confidence\", 0.5) * self.SEVERITY_WEIGHTS.get(i.get(\"severity\", \"low\"), 0.3) \n",
+    "                  for i in indicators]\n",
+    "        score = sum(scores) / len(scores) if scores else 0\n",
+    "        risk = \"critical\" if score >= 0.8 else \"high\" if score >= 0.6 else \"medium\" if score >= 0.4 else \"low\"\n",
+    "        return score, risk\n",
+    "\n",
+    "class CyberForgeAgent:\n",
+    "    def __init__(self):\n",
+    "        self.engine = DecisionEngine()\n",
+    "    \n",
+    "    def analyze(self, url: str, data: Dict) -> Dict:\n",
+    "        indicators = self._extract_indicators(data)\n",
+    "        score, risk = self.engine.calculate_threat_score(indicators)\n",
+    "        action = \"block\" if score >= 0.8 else \"alert\" if score >= 0.6 else \"monitor\" if score >= 0.4 else \"allow\"\n",
+    "        \n",
+    "        return AgentDecision(\n",
+    "            action=action,\n",
+    "            confidence=score,\n",
+    "            reasoning=f\"Threat score: {score:.2f}. {len(indicators)} indicators found.\",\n",
+    "            evidence=[str(i) for i in indicators[:3]],\n",
+    "            risk_level=risk,\n",
+    "            recommended_follow_up=[\"Continue monitoring\"]\n",
+    "        ).to_dict()\n",
+    "    \n",
+    "    def _extract_indicators(self, data: Dict) -> List[Dict]:\n",
+    "        indicators = []\n",
+    "        sec = data.get(\"security_report\", {})\n",
+    "        if not sec.get(\"is_https\", True):\n",
+    "            indicators.append({\"type\": \"insecure\", \"severity\": \"medium\", \"confidence\": 0.9})\n",
+    "        if sec.get(\"mixed_content\"):\n",
+    "            indicators.append({\"type\": \"mixed_content\", \"severity\": \"medium\", \"confidence\": 0.85})\n",
+    "        return indicators\n",
+    "'''\n",
+    "\n",
+    "module_path = AGENT_DIR / \"cyberforge_agent.py\"\n",
+    "with open(module_path, 'w') as f:\n",
+    "    f.write(agent_module)\n",
+    "\n",
+    "print(f\"✓ Agent module saved to: {module_path}\")"
+   ]
+  },
+  {
+   "cell_type": "markdown",
+   "id": "31978536",
+   "metadata": {},
+   "source": [
+    "## 8. Summary"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "id": "d6e9505c",
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "print(\"\\n\" + \"=\" * 60)\n",
+    "print(\"AGENT INTELLIGENCE COMPLETE\")\n",
+    "print(\"=\" * 60)\n",
+    "\n",
+    "print(f\"\"\"\n",
+    "🤖 Agent Capabilities:\n",
+    "   - Decision Scoring: Weighted threat assessment\n",
+    "   - Gemini Integration: AI-powered reasoning\n",
+    "   - Task Queue: Priority-based execution\n",
+    "   - Action History: Full audit trail\n",
+    "\n",
+    "📊 Test Results:\n",
+    "   - Action: {decision.action}\n",
+    "   - Confidence: {decision.confidence:.2%}\n",
+    "   - Risk Level: {decision.risk_level}\n",
+    "\n",
+    "📁 Output Files:\n",
+    "   - Config: {AGENT_DIR}/agent_config.json\n",
+    "   - Module: {AGENT_DIR}/cyberforge_agent.py\n",
+    "\n",
+    "Next step:\n",
+    "  → 05_model_validation.ipynb\n",
+    "\"\"\")\n",
+    "print(\"=\" * 60)"
+   ]
+  }
+ ],
+ "metadata": {
+  "language_info": {
+   "name": "python"
+  }
+ },
+ "nbformat": 4,
+ "nbformat_minor": 5
+}