feat(agent): Agregamos soporte para VirusTotal IP report.

src/custom_tools.py

@@ -1,4 +1,5 @@
 import requests
+import os
 from crewai.tools import BaseTool
 from typing import Type, List
 from pydantic import BaseModel, Field
@@ -42,22 +43,48 @@ class IPInfoGeoLookup(BaseTool):
                 
         return "\n".join(results)
 
-# --- 2. VirusTotal Scanner Tool ---
-class VirusTotalToolInput(BaseModel):
-    """Input schema for VirusTotal Scanner Tool."""
-    resources: List[str] = Field(
+# --- 2. VirusTotal IP Report ---
+class VirusTotalIPReportInput(BaseModel):
+    """Input schema for VirusTotal IP Report Tool."""
+    ip_address: str = Field(
         ..., 
-        description="A list of resources to scan. Valid resources include file hash (MD5, SHA256), a URL, a domain, or an IP address."
+        description="The IP address to scan. Valid resources include IPv4 or IPv6 address."
     )
 
-class VirusTotalScanner(BaseTool):
+class VirusTotalIPReport(BaseTool):
     # See https://blog.virustotal.com/2024/08/VT-S1-EffectiveResearch.html
     # See https://docs.virustotal.com/reference/ip-info
-    name: str = "VirusTotal Scanner"
-    description: str = "Analyzes files, URLs, domains, or IP addresses for malware and other security threats using multiple antivirus engines and reputation services. Provides a detailed security analysis report."
-    args_schema: Type[BaseModel] = VirusTotalToolInput
-
-    def _run(self, resources: List[str]) -> str:
-        # Placeholder logic for the actual VirusTotal API call
-        print(f"DEBUG: Running VirusTotal Scan for {resources}")
-        return f"Simulation: Resource {resources} analyzed. 0/90 engines flagged it as malicious. Reputation: Clean."
+    name: str = "VirusTotal IP Report"
+    description: str = "Analyzes an IP address for malware and other security threats using multiple antivirus engines and reputation services. Provides a detailed security analysis report."
+    args_schema: Type[BaseModel] = VirusTotalIPReportInput
+
+    def _run(self, ip_address: str) -> str:
+        api_key = os.getenv("VT_APIKEY")
+        report = []
+
+        if not api_key:
+            return "Tool error: The VT_APIKEY environment variable is not set."
+        
+        try:
+            url = f"https://www.virustotal.com/api/v3/ip_addresses/{ip_address}"
+            headers = {"x-apikey": api_key} 
+            response = requests.get(url, headers=headers)
+            response.raise_for_status()
+            data = response.json()
+            
+            # Formateamos la salida para que sea legible y útil para el agente
+            result_str = (
+                f"IP: {data.get('data', {}).get('id')}",
+                f"Country: {data.get('data', {}).get('attributes', {}).get('country')}",
+                f"ASN Owner: {data.get('data', {}).get('attributes', {}).get('as_owner')}",
+                f"Reputation: {data.get('data', {}).get('attributes', {}).get('reputation')}",
+                f"Last Analysis Date: {data.get('data', {}).get('attributes', {}).get('last_analysis_date')}",
+                f"Malicious Detections: {data.get('data', {}).get('attributes', {}).get('last_analysis_stats', {}).get('malicious')}",
+                f"Harmless Detections: {data.get('data', {}).get('attributes', {}).get('last_analysis_stats', {}).get('harmless')}",
+                f"Suspicious Detections: {data.get('data', {}).get('attributes', {}).get('last_analysis_stats', {}).get('suspicious')}"
+            )
+
+            return "\n".join(result_str)
+
+        except requests.exceptions.RequestException as e:
+            return f"Error al consultar la IP {ip_address}: {e}"

src/incident_crew.py

@@ -1,5 +1,5 @@
 from crewai import Agent, Task, Crew, Process, LLM
-from custom_tools import IPInfoGeoLookup
+from custom_tools import IPInfoGeoLookup, VirusTotalIPReport
 
 class IncidentReporterCrew:
     def __init__(self, api_key):
@@ -7,7 +7,8 @@ class IncidentReporterCrew:
 
         self.llm = LLM(
             #model="llama-3.3-70b-versatile",
-            model="openai/gpt-oss-120b:free",
+            #model="openai/gpt-oss-120b:free",
+            model="google/gemini-2.5-flash",
             temperature=0.7,
             provider="openai",
         )
@@ -18,7 +19,7 @@ class IncidentReporterCrew:
             goal="Rapidly identify, extract, and analyze key Indicators of Compromise (IOCs) from initial security alerts to provide structured and actionable intelligence.",
             backstory="Highly specialized in threat intelligence, capable of parsing raw incident data, identifying patterns, and performing virtual lookups on security intelligence databases (like VirusTotal, IPInfo, etc.). Your output must be a concise, structured summary.",
             verbose=True,
-            tools=[IPInfoGeoLookup()],
+            tools=[IPInfoGeoLookup(), VirusTotalIPReport()],
             allow_delegation=False,
             llm=self.llm,
         )