test_agent1.py

#Testing file for agent1
#Agent1 used to summarize the logs into sentences, basic summaries
#Fail-safe file 
#Identifies the number of anomalies
#Only outputs the first three anomalies 
import json
import ollama

def load_and_filter_logs(filepath):
    """Filters out the noise to find only the anomalies."""
    with open(filepath, 'r') as f:
        logs = json.load(f)
    
    anomalies = []
    for log in logs:
        # Filter Nginx Logs: Ignore HTTP 200
        if log.get("log_type") == "nginx_waf" and log.get("status_code") != 200:
            anomalies.append(log)
        # Filter Auth Logs: Ignore successful logins and standard session opens
        elif log.get("log_type") == "linux_auth" and log.get("event_type") not in ["authentication_success", "session_opened"]:
            anomalies.append(log)
            
    return anomalies

def agent_1_parser(raw_log):
    """Agent 1: Translates JSON into a human-readable summary."""
    prompt = f"""
    You are a Senior Log Parser. Your job is to read this raw JSON log and output a ONE SENTENCE summary of the activity. 
    Do not explain the JSON. Just state what happened, focusing on the IP, the user (if any), and the action.
    
    Log Data: {json.dumps(raw_log)}
    """
    
    # Sending the prompt to your local L4 GPU running Qwen2
    response = ollama.chat(model='qwen2:7b', messages=[{'role': 'user', 'content': prompt}])
    return response['message']['content']

def main():
    print("[*] Booting up Agent 1 Test...")
    anomalous_logs = load_and_filter_logs('logs.json')
    
    print(f"[*] Filter caught {len(anomalous_logs)} anomalies.")
    print("[*] Running Agent 1 on the first 3 anomalies to test the prompt...\n")

    # We use slicing [:3] to only test the first three items for speed
    for idx, log in enumerate(anomalous_logs[:3]):
        print(f"--- Testing Anomaly {idx + 1} ---")
        summary = agent_1_parser(log)
        print(f"Agent 1 Output:\n{summary}\n")

if __name__ == "__main__":
    main()