intelligence

package
v0.2.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jun 20, 2025 License: MIT Imports: 5 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type ActorType 

type ActorType string

ActorType defines threat actor types 

const (
	ActorNationState ActorType = "nation_state"
	ActorCriminal    ActorType = "criminal"
	ActorHacktivist  ActorType = "hacktivist"
	ActorInsider     ActorType = "insider"
	ActorResearcher  ActorType = "researcher"
	ActorUnknown     ActorType = "unknown"
)

type CVSSScore 

type CVSSScore struct {
	Version            string  `json:"version"`
	BaseScore          float64 `json:"base_score"`
	TemporalScore      float64 `json:"temporal_score"`
	EnvironmentalScore float64 `json:"environmental_score"`
	Vector             string  `json:"vector"`
}

CVSSScore represents CVSS scoring

type CampaignStatus 

type CampaignStatus string

CampaignStatus defines campaign status 

const (
	CampaignActive    CampaignStatus = "active"
	CampaignDormant   CampaignStatus = "dormant"
	CampaignCompleted CampaignStatus = "completed"
	CampaignSuspected CampaignStatus = "suspected"
)

type CampaignTarget 

type CampaignTarget struct {
	Type      string   `json:"type"`
	Sector    string   `json:"sector"`
	Geography []string `json:"geography"`
	Systems   []string `json:"systems"`
}

CampaignTarget represents a campaign target

type CampaignTimeline 

type CampaignTimeline struct {
	Started  time.Time  `json:"started"`
	Ended    *time.Time `json:"ended,omitempty"`
	Active   bool       `json:"active"`
	Duration string     `json:"duration"`
}

CampaignTimeline represents campaign timeline

type ConfidenceLevel 

type ConfidenceLevel string

ConfidenceLevel defines confidence levels 

const (
	ConfidenceConfirmed ConfidenceLevel = "confirmed"
	ConfidenceHigh      ConfidenceLevel = "high"
	ConfidenceMedium    ConfidenceLevel = "medium"
	ConfidenceLow       ConfidenceLevel = "low"
	ConfidenceUnknown   ConfidenceLevel = "unknown"
)

type CorrelatedEntity 

type CorrelatedEntity struct {
	Type   string  `json:"type"`
	ID     string  `json:"id"`
	Role   string  `json:"role"`
	Weight float64 `json:"weight"`
}

CorrelatedEntity represents a correlated entity

type Correlation 

type Correlation struct {
	ID        string                 `json:"id"`
	Type      CorrelationType        `json:"type"`
	Entities  []CorrelatedEntity     `json:"entities"`
	Strength  float64                `json:"strength"`
	Evidence  []string               `json:"evidence"`
	CreatedAt time.Time              `json:"created_at"`
	Metadata  map[string]interface{} `json:"metadata"`
}

Correlation represents a threat correlation

type CorrelationRule 

type CorrelationRule struct {
	ID          string                 `json:"id"`
	Name        string                 `json:"name"`
	Description string                 `json:"description"`
	Conditions  []RuleCondition        `json:"conditions"`
	Actions     []RuleAction           `json:"actions"`
	Priority    int                    `json:"priority"`
	Enabled     bool                   `json:"enabled"`
	Metadata    map[string]interface{} `json:"metadata"`
}

CorrelationRule defines correlation rules

type CorrelationType 

type CorrelationType string

CorrelationType defines correlation types 

const (
	CorrelationActorIOC        CorrelationType = "actor_ioc"
	CorrelationCampaignTTP     CorrelationType = "campaign_ttp"
	CorrelationVulnExploit     CorrelationType = "vuln_exploit"
	CorrelationIncidentPattern CorrelationType = "incident_pattern"
)

type DataPoint 

type DataPoint struct {
	Timestamp time.Time   `json:"timestamp"`
	Value     float64     `json:"value"`
	Label     string      `json:"label"`
	Metadata  interface{} `json:"metadata,omitempty"`
}

DataPoint represents a data point

type EmergingRisk 

type EmergingRisk struct {
	ID          string    `json:"id"`
	Description string    `json:"description"`
	Indicators  []string  `json:"indicators"`
	Likelihood  float64   `json:"likelihood"`
	FirstSeen   time.Time `json:"first_seen"`
}

EmergingRisk represents an emerging risk

type FeedStatus 

type FeedStatus string

FeedStatus defines feed status 

const (
	FeedActive   FeedStatus = "active"
	FeedInactive FeedStatus = "inactive"
	FeedError    FeedStatus = "error"
	FeedUpdating FeedStatus = "updating"
)

type FeedType 

type FeedType string

FeedType defines types of threat feeds 

const (
	FeedVulnerability FeedType = "vulnerability"
	FeedIndicator     FeedType = "indicator"
	FeedTactic        FeedType = "tactic"
	FeedActor         FeedType = "actor"
	FeedIncident      FeedType = "incident"
	FeedResearch      FeedType = "research"
)

type ForecastPoint 

type ForecastPoint struct {
	Timestamp  time.Time `json:"timestamp"`
	Value      float64   `json:"value"`
	Confidence float64   `json:"confidence"`
	Upper      float64   `json:"upper_bound"`
	Lower      float64   `json:"lower_bound"`
}

ForecastPoint represents a forecast point

type HistoricalData 

type HistoricalData struct {
	TimeRange  TimeRange              `json:"time_range"`
	Incidents  []HistoricalIncident   `json:"incidents"`
	Statistics map[string]interface{} `json:"statistics"`
}

HistoricalData represents historical threat data

type HistoricalIncident 

type HistoricalIncident struct {
	ID         string                 `json:"id"`
	Date       time.Time              `json:"date"`
	Type       string                 `json:"type"`
	Severity   SeverityLevel          `json:"severity"`
	Actors     []string               `json:"actors"`
	Techniques []string               `json:"techniques"`
	Impact     string                 `json:"impact"`
	Resolution string                 `json:"resolution"`
	Metadata   map[string]interface{} `json:"metadata"`
}

HistoricalIncident represents a historical incident

type ImpactAssessment 

type ImpactAssessment struct {
	Severity        SeverityLevel `json:"severity"`
	Scope           string        `json:"scope"`
	DataCompromised bool          `json:"data_compromised"`
	SystemsAffected int           `json:"systems_affected"`
	FinancialImpact string        `json:"financial_impact,omitempty"`
	Reputation      string        `json:"reputation_impact,omitempty"`
}

ImpactAssessment represents impact assessment

type IndicatorType 

type IndicatorType string

IndicatorType defines indicator types 

const (
	IndicatorPromptPattern IndicatorType = "prompt_pattern"
	IndicatorPayload       IndicatorType = "payload"
	IndicatorBehavior      IndicatorType = "behavior"
	IndicatorExfiltration  IndicatorType = "exfiltration"
	IndicatorEvasion       IndicatorType = "evasion"
	IndicatorPersistence   IndicatorType = "persistence"
)

type IntelConfig 

type IntelConfig struct {
	MaxFeeds          int
	UpdateInterval    time.Duration
	RetentionPeriod   time.Duration
	AnalysisDepth     int
	AutoCorrelation   bool
	PredictionEnabled bool
}

IntelConfig holds configuration for threat intelligence

type IntelRepository 

type IntelRepository struct {
	// contains filtered or unexported fields
}

IntelRepository manages intelligence storage

func NewIntelRepository 

func NewIntelRepository() *IntelRepository

NewIntelRepository creates a new intelligence repository

func (*IntelRepository) Store 

func (ir *IntelRepository) Store(dataType, id string, data interface{}) error

Store stores intelligence data

type IntelligenceAnalyzer 

type IntelligenceAnalyzer struct {
	// contains filtered or unexported fields
}

IntelligenceAnalyzer analyzes threat intelligence

func NewIntelligenceAnalyzer 

func NewIntelligenceAnalyzer() *IntelligenceAnalyzer

NewIntelligenceAnalyzer creates a new intelligence analyzer

func (*IntelligenceAnalyzer) AnalyzeThreatLandscape 

func (ia *IntelligenceAnalyzer) AnalyzeThreatLandscape(ctx context.Context, data map[string]interface{}) (*ThreatLandscape, error)

AnalyzeThreatLandscape analyzes the threat landscape

type Mitigation 

type Mitigation struct {
	ID             string                 `json:"id"`
	Name           string                 `json:"name"`
	Description    string                 `json:"description"`
	Type           MitigationType         `json:"type"`
	Effectiveness  float64                `json:"effectiveness"`
	Implementation string                 `json:"implementation"`
	Metadata       map[string]interface{} `json:"metadata"`
}

Mitigation represents a mitigation strategy

type MitigationType 

type MitigationType string

MitigationType defines mitigation types 

const (
	MitigationPreventive   MitigationType = "preventive"
	MitigationDetective    MitigationType = "detective"
	MitigationCorrective   MitigationType = "corrective"
	MitigationCompensating MitigationType = "compensating"
)

type Patch 

type Patch struct {
	ID          string    `json:"id"`
	Version     string    `json:"version"`
	ReleaseDate time.Time `json:"release_date"`
	Description string    `json:"description"`
	DownloadURL string    `json:"download_url"`
}

Patch represents a security patch

type Pattern 

type Pattern struct {
	ID          string                 `json:"id"`
	Type        string                 `json:"type"`
	Description string                 `json:"description"`
	Frequency   int                    `json:"frequency"`
	Indicators  []string               `json:"indicators"`
	FirstSeen   time.Time              `json:"first_seen"`
	LastSeen    time.Time              `json:"last_seen"`
	Metadata    map[string]interface{} `json:"metadata"`
}

Pattern represents an identified pattern

type Prediction 

type Prediction struct {
	ID              string                 `json:"id"`
	Type            PredictionType         `json:"type"`
	Description     string                 `json:"description"`
	Probability     float64                `json:"probability"`
	Impact          SeverityLevel          `json:"impact"`
	TimeFrame       string                 `json:"timeframe"`
	Indicators      []string               `json:"indicators"`
	Recommendations []string               `json:"recommendations"`
	Confidence      ConfidenceLevel        `json:"confidence"`
	CreatedAt       time.Time              `json:"created_at"`
	ValidUntil      time.Time              `json:"valid_until"`
	Metadata        map[string]interface{} `json:"metadata"`
}

Prediction represents a threat prediction

type PredictionModel 

type PredictionModel struct {
	ID          string                 `json:"id"`
	Name        string                 `json:"name"`
	Type        string                 `json:"type"`
	Version     string                 `json:"version"`
	Accuracy    float64                `json:"accuracy"`
	Features    []string               `json:"features"`
	LastTrained time.Time              `json:"last_trained"`
	Metadata    map[string]interface{} `json:"metadata"`
}

PredictionModel represents a prediction model

type PredictionType 

type PredictionType string

PredictionType defines prediction types 

const (
	PredictionAttack        PredictionType = "attack"
	PredictionVulnerability PredictionType = "vulnerability"
	PredictionCampaign      PredictionType = "campaign"
	PredictionTechnique     PredictionType = "technique"
)

type ReliabilityScore 

type ReliabilityScore float64

ReliabilityScore defines feed reliability 

const (
	ReliabilityUnknown  ReliabilityScore = 0.0
	ReliabilityLow      ReliabilityScore = 0.25
	ReliabilityMedium   ReliabilityScore = 0.50
	ReliabilityHigh     ReliabilityScore = 0.75
	ReliabilityVeryHigh ReliabilityScore = 1.0
)

type ResourceLevel 

type ResourceLevel string

ResourceLevel defines resource levels 

const (
	ResourceIndividual   ResourceLevel = "individual"
	ResourceGroup        ResourceLevel = "group"
	ResourceOrganization ResourceLevel = "organization"
	ResourceGovernment   ResourceLevel = "government"
)

type RiskLevel 

type RiskLevel string

RiskLevel defines risk levels 

const (
	RiskCritical RiskLevel = "critical"
	RiskHigh     RiskLevel = "high"
	RiskMedium   RiskLevel = "medium"
	RiskLow      RiskLevel = "low"
)

type RuleAction 

type RuleAction struct {
	Type       string                 `json:"type"`
	Parameters map[string]interface{} `json:"parameters"`
}

RuleAction represents a rule action

type RuleCondition 

type RuleCondition struct {
	Field    string      `json:"field"`
	Operator string      `json:"operator"`
	Value    interface{} `json:"value"`
}

RuleCondition represents a rule condition

type SeverityLevel 

type SeverityLevel string

SeverityLevel defines severity levels 

const (
	SeverityCritical SeverityLevel = "critical"
	SeverityHigh     SeverityLevel = "high"
	SeverityMedium   SeverityLevel = "medium"
	SeverityLow      SeverityLevel = "low"
	SeverityInfo     SeverityLevel = "info"
)

type SophisticationLevel 

type SophisticationLevel string

SophisticationLevel defines sophistication levels 

const (
	SophisticationNovice       SophisticationLevel = "novice"
	SophisticationIntermediate SophisticationLevel = "intermediate"
	SophisticationAdvanced     SophisticationLevel = "advanced"
	SophisticationExpert       SophisticationLevel = "expert"
)

type TTP 

type TTP struct {
	ID          string                 `json:"id"`
	Tactic      string                 `json:"tactic"`
	Technique   string                 `json:"technique"`
	Procedure   string                 `json:"procedure"`
	Description string                 `json:"description"`
	Examples    []string               `json:"examples"`
	Metadata    map[string]interface{} `json:"metadata"`
}

TTP represents Tactics, Techniques, and Procedures

type ThreatActor 

type ThreatActor struct {
	ID             string                 `json:"id"`
	Name           string                 `json:"name"`
	Aliases        []string               `json:"aliases"`
	Type           ActorType              `json:"type"`
	Motivation     []string               `json:"motivation"`
	Sophistication SophisticationLevel    `json:"sophistication"`
	Resources      ResourceLevel          `json:"resources"`
	Intent         []string               `json:"intent"`
	Capabilities   []string               `json:"capabilities"`
	TTPs           []TTP                  `json:"ttps"`
	TargetSectors  []string               `json:"target_sectors"`
	OriginCountry  string                 `json:"origin_country,omitempty"`
	Active         bool                   `json:"active"`
	FirstSeen      time.Time              `json:"first_seen"`
	LastSeen       time.Time              `json:"last_seen"`
	Metadata       map[string]interface{} `json:"metadata"`
}

ThreatActor represents a threat actor

type ThreatCampaign 

type ThreatCampaign struct {
	ID          string                 `json:"id"`
	Name        string                 `json:"name"`
	Description string                 `json:"description"`
	Actors      []string               `json:"actors"`
	Targets     []CampaignTarget       `json:"targets"`
	Timeline    CampaignTimeline       `json:"timeline"`
	Objectives  []string               `json:"objectives"`
	TTPs        []TTP                  `json:"ttps"`
	Indicators  []string               `json:"indicators"`
	Impact      ImpactAssessment       `json:"impact"`
	Status      CampaignStatus         `json:"status"`
	Metadata    map[string]interface{} `json:"metadata"`
}

ThreatCampaign represents a threat campaign

type ThreatCorrelator 

type ThreatCorrelator struct {
	// contains filtered or unexported fields
}

ThreatCorrelator correlates threat data

func NewThreatCorrelator 

func NewThreatCorrelator() *ThreatCorrelator

NewThreatCorrelator creates a new threat correlator

func (*ThreatCorrelator) CorrelateIndicators 

func (tc *ThreatCorrelator) CorrelateIndicators(indicators []*ThreatIndicator)

CorrelateIndicators correlates threat indicators

type ThreatFeed 

type ThreatFeed struct {
	ID          string                 `json:"id"`
	Name        string                 `json:"name"`
	Type        FeedType               `json:"type"`
	Source      string                 `json:"source"`
	URL         string                 `json:"url"`
	Format      string                 `json:"format"`
	Frequency   time.Duration          `json:"frequency"`
	LastUpdate  time.Time              `json:"last_update"`
	Status      FeedStatus             `json:"status"`
	Reliability ReliabilityScore       `json:"reliability"`
	Metadata    map[string]interface{} `json:"metadata"`
}

ThreatFeed represents a threat intelligence feed

type ThreatIndicator 

type ThreatIndicator struct {
	ID          string                 `json:"id"`
	Type        IndicatorType          `json:"type"`
	Value       string                 `json:"value"`
	Pattern     string                 `json:"pattern"`
	Description string                 `json:"description"`
	Severity    SeverityLevel          `json:"severity"`
	Confidence  ConfidenceLevel        `json:"confidence"`
	FirstSeen   time.Time              `json:"first_seen"`
	LastSeen    time.Time              `json:"last_seen"`
	ValidUntil  *time.Time             `json:"valid_until,omitempty"`
	Tags        []string               `json:"tags"`
	RelatedIOCs []string               `json:"related_iocs"`
	Mitigations []Mitigation           `json:"mitigations"`
	Metadata    map[string]interface{} `json:"metadata"`
}

ThreatIndicator represents a threat indicator

type ThreatIntelligenceSystem 

type ThreatIntelligenceSystem struct {
	// contains filtered or unexported fields
}

ThreatIntelligenceSystem manages threat intelligence for LLM attacks

func NewThreatIntelligenceSystem 

func NewThreatIntelligenceSystem(config IntelConfig) *ThreatIntelligenceSystem

NewThreatIntelligenceSystem creates a new threat intelligence system

func (*ThreatIntelligenceSystem) AddFeed 

func (tis *ThreatIntelligenceSystem) AddFeed(ctx context.Context, feed *ThreatFeed) error

AddFeed adds a threat intelligence feed

func (*ThreatIntelligenceSystem) ImportIndicators 

func (tis *ThreatIntelligenceSystem) ImportIndicators(ctx context.Context, indicators []*ThreatIndicator) error

ImportIndicators imports threat indicators

func (*ThreatIntelligenceSystem) SearchIndicators 

func (tis *ThreatIntelligenceSystem) SearchIndicators(ctx context.Context, query string) ([]*ThreatIndicator, error)

SearchIndicators searches for threat indicators

type ThreatLandscape 

type ThreatLandscape struct {
	Timestamp     time.Time              `json:"timestamp"`
	RiskLevel     RiskLevel              `json:"risk_level"`
	TopThreats    []ThreatSummary        `json:"top_threats"`
	EmergingRisks []EmergingRisk         `json:"emerging_risks"`
	Trends        []Trend                `json:"trends"`
	Predictions   []Prediction           `json:"predictions"`
	Metadata      map[string]interface{} `json:"metadata"`
}

ThreatLandscape represents the current threat landscape

type ThreatPredictor 

type ThreatPredictor struct {
	// contains filtered or unexported fields
}

ThreatPredictor predicts threats

func NewThreatPredictor 

func NewThreatPredictor() *ThreatPredictor

NewThreatPredictor creates a new threat predictor

func (*ThreatPredictor) PredictThreats 

func (tp *ThreatPredictor) PredictThreats(ctx context.Context, timeframe time.Duration) ([]*Prediction, error)

PredictThreats predicts future threats

type ThreatSummary 

type ThreatSummary struct {
	ID         string        `json:"id"`
	Name       string        `json:"name"`
	Type       string        `json:"type"`
	Severity   SeverityLevel `json:"severity"`
	Prevalence float64       `json:"prevalence"`
	Impact     string        `json:"impact"`
}

ThreatSummary summarizes a threat

type TimeRange 

type TimeRange struct {
	Start time.Time `json:"start"`
	End   time.Time `json:"end"`
}

TimeRange represents a time range

type Trend 

type Trend struct {
	ID         string                 `json:"id"`
	Name       string                 `json:"name"`
	Type       TrendType              `json:"type"`
	Direction  TrendDirection         `json:"direction"`
	Magnitude  float64                `json:"magnitude"`
	TimeWindow time.Duration          `json:"time_window"`
	DataPoints []DataPoint            `json:"data_points"`
	Forecast   []ForecastPoint        `json:"forecast"`
	Metadata   map[string]interface{} `json:"metadata"`
}

Trend represents a threat trend

type TrendDirection 

type TrendDirection string

TrendDirection defines trend directions 

const (
	TrendIncreasing TrendDirection = "increasing"
	TrendDecreasing TrendDirection = "decreasing"
	TrendStable     TrendDirection = "stable"
	TrendVolatile   TrendDirection = "volatile"
)

type TrendType 

type TrendType string

TrendType defines trend types 

const (
	TrendAttackVolume       TrendType = "attack_volume"
	TrendTechniqueEvolution TrendType = "technique_evolution"
	TrendActorActivity      TrendType = "actor_activity"
	TrendVulnerability      TrendType = "vulnerability"
)

type VulnCategory 

type VulnCategory string

VulnCategory defines vulnerability categories 

const (
	VulnPromptInjection VulnCategory = "prompt_injection"
	VulnJailbreak       VulnCategory = "jailbreak"
	VulnDataLeakage     VulnCategory = "data_leakage"
	VulnModelExtraction VulnCategory = "model_extraction"
	VulnSupplyChain     VulnCategory = "supply_chain"
	VulnAccessControl   VulnCategory = "access_control"
	VulnDenialOfService VulnCategory = "denial_of_service"
)

type VulnerabilityIntel 

type VulnerabilityIntel struct {
	ID               string                 `json:"id"`
	CVE              string                 `json:"cve,omitempty"`
	Name             string                 `json:"name"`
	Description      string                 `json:"description"`
	Category         VulnCategory           `json:"category"`
	Severity         SeverityLevel          `json:"severity"`
	CVSS             *CVSSScore             `json:"cvss,omitempty"`
	AffectedModels   []string               `json:"affected_models"`
	ExploitAvailable bool                   `json:"exploit_available"`
	ExploitCode      string                 `json:"exploit_code,omitempty"`
	Patches          []Patch                `json:"patches"`
	Workarounds      []string               `json:"workarounds"`
	References       []string               `json:"references"`
	DiscoveredDate   time.Time              `json:"discovered_date"`
	PublishedDate    time.Time              `json:"published_date"`
	LastModified     time.Time              `json:"last_modified"`
	Metadata         map[string]interface{} `json:"metadata"`
}

VulnerabilityIntel represents vulnerability intelligence

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.