Upload dspy_log_generator.json with huggingface_hub
Browse files- dspy_log_generator.json +57 -0
dspy_log_generator.json
ADDED
|
@@ -0,0 +1,57 @@
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| 1 |
+
{
|
| 2 |
+
"generate.predict": {
|
| 3 |
+
"traces": [],
|
| 4 |
+
"train": [],
|
| 5 |
+
"demos": [
|
| 6 |
+
{
|
| 7 |
+
"augmented": true,
|
| 8 |
+
"structured_event": "{\"provider\": \"AWS\", \"action\": \"ACCESS\", \"entity_id\": \"user_alice\", \"target_id\": \"vm_021\", \"source_ip\": \"192.168.1.10\", \"region\": \"eu-west-1\", \"cloud_account\": \"acc_aws_123456\", \"status\": \"Success\", \"malicious\": 0, \"attack_phase\": \"benign\", \"edge_id\": \"user_alice__ACCESS__vm_021\", \"scenario_id\": \"scenario_00187\", \"t\": 18}",
|
| 9 |
+
"reasoning": "User access to vm_021 is benign as user_alice is not malicious and the scenario is scenario_00187 which is not related to an attack.",
|
| 10 |
+
"provider_log": "{\n \"eventVersion\": \"1.08\",\n \"eventTime\": \"2025-01-15T11:00:00Z\",\n \"eventSource\": \"ec2.amazonaws.com\",\n \"eventName\": \"DescribeInstances\",\n \"awsRegion\": \"eu-west-1\",\n \"sourceIPAddress\": \"192.168.1.10\",\n \"userAgent\": \"aws-sdk-python/1.34.0\",\n \"requestID\": \"E1C9C9C9C9C9C9C9C9C9C9C9\",\n \"eventID\": \"e0e0e0e0e0e0e0e0e0e0\",\n \"readOnly\": true,\n \"eventType\": \"AwsApiCall\",\n \"managementEvent\": false,\n \"userIdentity\": {\n \"type\": \"IAMUser\",\n \"arn\": \"arn:aws:iam::123456000000:user/alice\",\n \"accountId\": \"123456000000\",\n \"userName\": \"alice\"\n },\n \"requestParameters\": {\n \"resourceId\": \"021\",\n \"region\": \"eu-west-1\"\n },\n \"responseElements\": {\n \"requestId\": \"E1C9C9C9C9C9C9C9C9C9C9C9\",\n \"httpStatusCode\": 200\n },\n \"resources\": [\n {\n \"ARN\": \"arn:aws:iam::123456000000:vm/021\",\n \"accountId\": \"123456000000\",\n \"type\": \"AWS::EC2::Instance\"\n }\n ],\n \"errorCode\": null,\n \"errorMessage\": null,\n \"_pipeline_meta\": {\n \"edge_id\": \"user_alice__ACCESS__vm_021\",\n \"scenario_id\": \"scenario_00187\",\n \"t\": 18,\n \"malicious\": 0,\n \"attack_phase\": \"benign\",\n \"original_provider\": \"AWS\",\n \"is_cross_cloud\": false\n }\n}"
|
| 11 |
+
},
|
| 12 |
+
{
|
| 13 |
+
"augmented": true,
|
| 14 |
+
"structured_event": "{\"provider\": \"AWS\", \"action\": \"ACCESS\", \"entity_id\": \"user_bob\", \"target_id\": \"vm_012\", \"source_ip\": \"10.0.0.5\", \"region\": \"us-east-1\", \"cloud_account\": \"acc_aws_123456\", \"status\": \"Success\", \"malicious\": 0, \"attack_phase\": \"benign\", \"edge_id\": \"user_bob__ACCESS__vm_012\", \"scenario_id\": \"scenario_00467\", \"t\": 16}",
|
| 15 |
+
"reasoning": "User bob is accessing vm_012 as part of a benign activity with scenario_id scenario_00467 at t=16. No malicious activity detected.",
|
| 16 |
+
"provider_log": "{\n \"eventVersion\": \"1.08\",\n \"eventTime\": \"2025-01-15T10:40:00Z\",\n \"eventSource\": \"ec2.amazonaws.com\",\n \"eventName\": \"DescribeInstances\",\n \"awsRegion\": \"us-east-1\",\n \"sourceIPAddress\": \"10.0.0.5\",\n \"userAgent\": \"aws-sdk-python/1.34.0\",\n \"requestID\": \"E1C9C9C9C9C9C9C9C9C9C9C9\",\n \"eventID\": \"e2e0e0e0e0e0e0e0e0e0e0\",\n \"readOnly\": true,\n \"eventType\": \"AwsApiCall\",\n \"managementEvent\": false,\n \"userIdentity\": {\n \"type\": \"IAMUser\",\n \"arn\": \"arn:aws:iam::123456000000:user/bob\",\n \"accountId\": \"123456000000\",\n \"userName\": \"bob\"\n },\n \"requestParameters\": {\n \"resourceId\": \"012\",\n \"region\": \"us-east-1\"\n },\n \"responseElements\": {\n \"requestId\": \"E1C9C9C9C9C9C9C9C9C9C9C9\",\n \"httpStatusCode\": 200\n },\n \"resources\": [\n {\n \"ARN\": \"arn:aws:iam::123456000000:vm/012\",\n \"accountId\": \"123456000000\",\n \"type\": \"AWS::EC2::Instance\"\n }\n ],\n \"errorCode\": null,\n \"errorMessage\": null,\n \"_pipeline_meta\": {\n \"edge_id\": \"user_bob__ACCESS__vm_012\",\n \"scenario_id\": \"scenario_00467\",\n \"t\": 16,\n \"malicious\": 0,\n \"attack_phase\": \"benign\"\n }\n}"
|
| 17 |
+
},
|
| 18 |
+
{
|
| 19 |
+
"augmented": true,
|
| 20 |
+
"structured_event": "{\"provider\": \"AWS\", \"action\": \"ACCESS\", \"entity_id\": \"user_bob\", \"target_id\": \"vm_012\", \"source_ip\": \"10.0.0.5\", \"region\": \"us-east-1\", \"cloud_account\": \"acc_aws_123456\", \"status\": \"Success\", \"malicious\": 0, \"attack_phase\": \"benign\", \"edge_id\": \"user_bob__ACCESS__vm_012\", \"scenario_id\": \"scenario_00594\", \"t\": 2}",
|
| 21 |
+
"reasoning": "User bob is accessing vm_012 as part of a legitimate activity.",
|
| 22 |
+
"provider_log": "{\n \"eventVersion\": \"1.08\",\n \"eventTime\": \"2025-01-15T08:20:00Z\",\n \"eventSource\": \"ec2.amazonaws.com\",\n \"eventName\": \"DescribeInstances\",\n \"awsRegion\": \"us-east-1\",\n \"sourceIPAddress\": \"10.0.0.5\",\n \"userAgent\": \"aws-sdk-python/1.34.0\",\n \"requestID\": \"E1C9C9C9C9C9C9C9C9C9C9C9\",\n \"eventID\": \"e0c0c0c0c0c0c0c0c0c0c0\",\n \"readOnly\": true,\n \"eventType\": \"AwsApiCall\",\n \"managementEvent\": false,\n \"userIdentity\": {\n \"type\": \"IAMUser\",\n \"arn\": \"arn:aws:iam::123456000000:user/bob\",\n \"accountId\": \"123456000000\",\n \"userName\": \"bob\"\n },\n \"requestParameters\": {\n \"resourceId\": \"012\",\n \"region\": \"us-east-1\"\n },\n \"responseElements\": {\n \"requestId\": \"E1C9C9C9C9C9C9C9C9C9C9C\",\n \"httpStatusCode\": 200\n },\n \"resources\": [\n {\n \"ARN\": \"arn:aws:iam::123456000000:vm/012\",\n \"accountId\": \"123456000000\",\n \"type\": \"AWS::EC2::Instance\"\n }\n ],\n \"errorCode\": null,\n \"errorMessage\": null,\n \"_pipeline_meta\": {\n \"edge_id\": \"user_bob__ACCESS__vm_012\",\n \"scenario_id\": \"scenario_00594\",\n \"t\": 2,\n \"malicious\": 0,\n \"attack_phase\": \"benign\",\n \"original_provider\": \"AWS\",\n \"original_action\": \"ACCESS\",\n \"original_entity_id\": \"user_bob\",\n \"original_target_id\": \"vm_012\",\n \"is_cross_cloud\": false\n }\n}"
|
| 23 |
+
},
|
| 24 |
+
{
|
| 25 |
+
"augmented": true,
|
| 26 |
+
"structured_event": "{\"provider\": \"AWS\", \"action\": \"ACCESS\", \"entity_id\": \"user_john\", \"target_id\": \"vm_021\", \"source_ip\": \"192.168.1.10\", \"region\": \"eu-west-1\", \"cloud_account\": \"acc_aws_123456\", \"status\": \"Success\", \"malicious\": 0, \"attack_phase\": \"benign\", \"edge_id\": \"user_john__ACCESS__vm_021\", \"scenario_id\": \"scenario_00135\", \"t\": 6}",
|
| 27 |
+
"reasoning": "User john accessed vm_021 as part of a benign activity.",
|
| 28 |
+
"provider_log": "{\n \"eventVersion\": \"1.08\",\n \"eventTime\": \"2025-01-15T09:00:00Z\",\n \"eventSource\": \"ec2.amazonaws.com\",\n \"eventName\": \"DescribeInstances\",\n \"awsRegion\": \"eu-west-1\",\n \"sourceIPAddress\": \"192.168.1.10\",\n \"userAgent\": \"aws-sdk-python/1.34.0\",\n \"requestID\": \"E1C9C9C9C9C9C9C9C9C9C9C9\",\n \"eventID\": \"e0e0e0e0e0e0e0e0e0e0\",\n \"readOnly\": true,\n \"eventType\": \"AwsApiCall\",\n \"managementEvent\": false,\n \"userIdentity\": {\n \"type\": \"IAMUser\",\n \"arn\": \"arn:aws:iam::123456000000:user/john\",\n \"accountId\": \"123456000000\",\n \"userName\": \"john\"\n },\n \"requestParameters\": {\n \"resourceId\": \"021\",\n \"region\": \"eu-west-1\"\n },\n \"responseElements\": {\n \"requestId\": \"E1C9C9C9C9C9C9C9C9C9C9C9\",\n \"httpStatusCode\": 200\n },\n \"resources\": [\n {\n \"ARN\": \"arn:aws:iam::123456000000:vm/021\",\n \"accountId\": \"123456000000\",\n \"type\": \"AWS::EC2::Instance\"\n }\n ],\n \"errorCode\": null,\n \"errorMessage\": null,\n \"_pipeline_meta\": {\n \"edge_id\": \"user_john__ACCESS__vm_021\",\n \"scenario_id\": \"scenario_00135\",\n \"t\": 6,\n \"malicious\": 0,\n \"attack_phase\": \"benign\",\n \"original_provider\": \"AWS\",\n \"original_action\": \"ACCESS\",\n \"original_entity_id\": \"user_john\",\n \"original_target_id\": \"vm_021\",\n \"is_cross_cloud\": false\n }\n}"
|
| 29 |
+
}
|
| 30 |
+
],
|
| 31 |
+
"signature": {
|
| 32 |
+
"instructions": "Convert a structured cloud security event into a provider-native JSON log.\nOutput ONLY valid JSON with a _pipeline_meta field.\nNo explanation. No markdown. No code fences.",
|
| 33 |
+
"fields": [
|
| 34 |
+
{
|
| 35 |
+
"prefix": "Structured Event:",
|
| 36 |
+
"description": "JSON dict: provider (AWS/Azure/GCP), action, entity_id, target_id, source_ip, region, cloud_account, status, malicious (0/1), attack_phase, edge_id, scenario_id, t"
|
| 37 |
+
},
|
| 38 |
+
{
|
| 39 |
+
"prefix": "Reasoning: Let's think step by step in order to",
|
| 40 |
+
"description": "${reasoning}"
|
| 41 |
+
},
|
| 42 |
+
{
|
| 43 |
+
"prefix": "Provider Log:",
|
| 44 |
+
"description": "Valid JSON log. AWS: CloudTrail with eventSource, eventName, awsRegion, userIdentity, sourceIPAddress, _pipeline_meta. Azure: Activity Log with time, operationName, correlationId, identity, _pipeline_meta. GCP: Cloud Logging with protoPayload, resource, severity, timestamp, _pipeline_meta. _pipeline_meta must contain edge_id, scenario_id, t, malicious, attack_phase."
|
| 45 |
+
}
|
| 46 |
+
]
|
| 47 |
+
},
|
| 48 |
+
"lm": null
|
| 49 |
+
},
|
| 50 |
+
"metadata": {
|
| 51 |
+
"dependency_versions": {
|
| 52 |
+
"python": "3.12",
|
| 53 |
+
"dspy": "3.1.3",
|
| 54 |
+
"cloudpickle": "3.1"
|
| 55 |
+
}
|
| 56 |
+
}
|
| 57 |
+
}
|