server/tasks.py

"""Task metadata for the SOC triage environment."""

from __future__ import annotations

TASKS: dict[str, dict[str, object]] = {
    "easy": {
        "id": "easy",
        "difficulty": "easy",
        "description": "Investigate a single security alert and submit a severity verdict.",
        "max_steps": 4,
        "grader": "grade_easy",
        "action_schema": {
            "tool_name": "list_tools|query_siem|get_threat_intel|pivot_alert|submit_verdict",
            "tool_args": "object",
            "classification": "required for submit_verdict: benign|low|medium|high|critical",
            "recommended_action": "required for submit_verdict: ignore|investigate|block|escalate",
            "reasoning": "required for submit_verdict: string",
        },
    },
    "medium": {
        "id": "medium",
        "difficulty": "medium",
        "description": "Investigate and rank an alert queue by urgency.",
        "max_steps": 5,
        "grader": "grade_medium",
        "action_schema": {
            "tool_name": "list_tools|query_siem|get_threat_intel|pivot_alert|submit_verdict",
            "tool_args": "object",
            "classification": "required for submit_verdict: comma-separated alert_ids in priority order",
            "recommended_action": "required for submit_verdict: monitor|investigate|escalate",
            "reasoning": "required for submit_verdict: string",
        },
    },
    "hard": {
        "id": "hard",
        "difficulty": "hard",
        "description": "Investigate noisy timeline and identify the kill-chain sequence.",
        "max_steps": 6,
        "grader": "grade_hard",
        "action_schema": {
            "tool_name": "list_tools|query_siem|get_threat_intel|pivot_alert|submit_verdict",
            "tool_args": "object",
            "classification": "required for submit_verdict: comma-separated alert_ids that form kill chain",
            "recommended_action": "required for submit_verdict: contain|eradicate|escalate|report",
            "reasoning": "required for submit_verdict: string",
        },
    },
}


def get_task(task_id: str) -> dict[str, object]:
    """Return task metadata or raise a clear error."""
    if task_id not in TASKS:
        raise ValueError(f"Unknown task_id '{task_id}'. Expected one of {list(TASKS)}")
    return TASKS[task_id]