https://live.paloaltonetworks.com/t5/cortex-xsoar-articles/xsoar-with-generative-ai-and-retrieval-augmented-generation/ta-p/1219466 <P class="lia-align-center" data-pm-slice="1 1 []"><FONT face="trebuchet ms,geneva"><STRONG><FONT size="6" color="#FF6600">Randy Uhrlaub, Cortex XSOAR Customer Success Architect</FONT></STRONG></FONT></P> <P>&nbsp;</P> <DIV class="lia-message-template-content-zone"> <P class="c19 c33 c24"><FONT face="trebuchet ms,geneva"><STRONG><FONT size="6" color="#FF6600"><SPAN class="c37 c25 c58">Table Of Content</SPAN></FONT></STRONG></FONT></P> <P class="c1 c15">&nbsp;</P> <P class="c1 c15"><FONT face="trebuchet ms,geneva"><LI-TOC indent="10" liststyle="square" maxheadinglevel="4"></LI-TOC></FONT></P> <P class="c1 c15">&nbsp;</P> <H2 id="h.91264avay42h" class="c33 c42"><FONT face="trebuchet ms,geneva"><STRONG><FONT color="#FF6600"><SPAN class="c11 c25 c41">Introduction</SPAN></FONT></STRONG></FONT></H2> <P>&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c11">Use of Generative AI (GenAI) and Retrieval Augmented Generation (RAG) with XSOAR is provided by the Anything LLM marketplace content pack. Anything LLM can be cloud-based or to address privacy, compliance, and</SPAN><SPAN class="c11">&nbsp;cost requirements; it can be installed on customer infrastructure.</SPAN><SPAN class="c2">&nbsp; A large selection of LLM models and vector databases are available in Anything LLM and custom LLM models can be imported. &nbsp;</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Use of GenAI in RAG with XSOAR allows a customer to incorporate their data:</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <UL class="c4 lst-kix_7f0xgvg04fmk-0 start"> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Private, customer data not used in training a commercial LLM model.</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Public data published after the LLM model training date.</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Dynamic data from XSOAR (incident, indicator, investigation, content, and documentation).</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Avoids expensive re-training and fine tuning of an LLM model.</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">RAG and context centered conversations are more accurate and not prone to hallucinations.</SPAN></FONT></LI> </UL> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Below are some examples of uses cases in XSOAR where GenAI and RAG can facilitate:</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <UL class="c4 lst-kix_prxvsqz1z26u-0 start"> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">XSOAR Integration Help</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">XSOAR Script Help</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">XSOAR Help</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">XSOAR Natural Language Command Interface</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">XSOAR Natural Language Search</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">XSOAR Investigation Summaries</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Policy and Procedure Guidance</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Threat Intel Blog Summaries</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Security Advisory Summaries</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c11">CVE summaries</SPAN></FONT></LI> </UL> <H3 class="c7">&nbsp;</H3> <H3 id="h.mp4v0yjb773y" class="c7"><FONT face="trebuchet ms,geneva"><STRONG><FONT color="#FF6600"><SPAN class="c11 c52">Retrieval Augmented Generation</SPAN></FONT></STRONG></FONT></H3> <P class="c1">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Retrieval Augment Generation incorporates external data and improves reliability of the generated responses and reduces or eliminates hallucinations by the LLM. &nbsp;External data is encoded and embedded as real number vectors in a vector database. &nbsp;An LLM prompt is first sent to the vector database and any similar results returned and added to the prompt’s conversation context before being sent to the LLM. &nbsp;This conversation context provides the primary information for the LLM to generate a response, versus relying on its training that may return statistically probable results which are not consistently accurate.</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c2">In Anything LLM, the default RAG configuration with the LanceDB vector database uses the following approach when embedding documents:</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <UL class="c4 lst-kix_pwqmjpsuhisi-0 start"> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Documents are split into up to 1,000 character chunks.</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Each chunk is converted into an array of 384 real numbers.</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Real number vectors for the document are added to the vector database.</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Similarity search returns the top N (4 -12) vectors based on cosine similarity of the embedded prompt to vectors in the database.</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Returned chunks of text are added to the prompt and conversation’s context and sent to the LLM.</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">The LLM returns the response to the prompt.</SPAN></FONT></LI> </UL> <H3 class="c7">&nbsp;</H3> <H3 id="h.y25g6g304rl2" class="c7"><FONT face="trebuchet ms,geneva" color="#FF6600"><STRONG><SPAN class="c29 c11">Text Search Augmented Generation</SPAN></STRONG></FONT></H3> <P>&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c11">While vector database similarity search provides a few, most similar results to the prompt, text search augments the prompt when a broader set of information is needed exceeding the results from similarity search of a vector database. &nbsp;For example, adding a list of Mitre ATT&amp;CK Tactics and Techniques or search results of XSOAR incidents and indicators into the conversation for a response from the LLM.</SPAN></FONT></P> <H2 id="h.kkp5hmcfijk" class="c18">&nbsp;</H2> <H2 id="h.mko9dfk9jw6d" class="c42 c33"><FONT face="trebuchet ms,geneva"><STRONG><FONT color="#FF6600"><SPAN class="c41 c11 c25">Anything LLM XSOAR Content Pack</SPAN></FONT></STRONG></FONT></H2> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c11">The Anything LLM content pack contains an integration, fields, incident type, layout, and scripts. &nbsp;The<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">AI Playground</SPAN></STRONG><SPAN class="c2">&nbsp;incident type and layout provides an environment to conduct prompt and data engineering for XSOAR use case implementation.</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c2">External documents, search results from XSOAR, and web links can be uploaded and embedded into a vector database. Similar results to the query from the vector database and direct injection of search results into the conversation context are combined with the query and sent to the LLM model to generate a response.</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <DIV id="tinyMceEditorRPrasadi_2" class="mceNonEditable lia-copypaste-placeholder">&nbsp;</DIV> <FONT face="trebuchet ms,geneva"><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="image3.jpg" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/65857i42D73E309D701C76/image-size/large?v=v2&amp;px=999" role="button" title="image3.jpg" alt="image3.jpg" /></span></FONT> <P><FONT face="trebuchet ms,geneva" color="#FF6600"><SPAN class="c2">Figure 01: XSOARandAnythingLLM_PaloAltoNetworks</SPAN></FONT></P> <P class="c19">&nbsp;</P> <H3 id="h.gtcp4o1hhuad" class="c7"><FONT face="trebuchet ms,geneva"><STRONG><FONT color="#FF6600"><SPAN class="c11">Customer Infrastructure</SPAN><SPAN class="c29 c11">&nbsp;Hosted</SPAN></FONT></STRONG></FONT></H3> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Anything LLM &nbsp;can be installed on customer infrastructure and supports a range of LLM models and locally installed vector databases. Example LLM models:</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <UL class="c4 lst-kix_h5uwtvtvdejo-0 start"> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Llama3</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Codellama</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Mistral</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Gemma</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Orca</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Phi</SPAN></FONT></LI> </UL> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Example vector databases:</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <UL class="c4 lst-kix_iuch07y348ky-0 start"> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">LanceDB</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Chroma</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Milvus</SPAN></FONT></LI> </UL> <H3 class="c7">&nbsp;</H3> <H3 id="h.5ggzytms9w3k" class="c7"><FONT face="trebuchet ms,geneva"><STRONG><FONT color="#FF6600"><SPAN class="c29 c11">Cloud Hosted</SPAN></FONT></STRONG></FONT></H3> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Anything LLM is also available as a cloud service and configured to use cloud-based LLM models and vector databases when data privacy is not a requirement. &nbsp;Examples of cloud-based LLM providers:</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <UL class="c4 lst-kix_x08r6vyoqs8v-0 start"> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">OpenAI</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Google Gemini</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Anthropic</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Cohere</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Hugging Face</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Perplexity</SPAN></FONT></LI> </UL> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Examples of cloud-based vector database providers:</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <UL class="c4 lst-kix_snxluzp62grr-0 start"> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Pinecode</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">QDrant</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Weaviate</SPAN></FONT></LI> </UL> <H3 class="c7">&nbsp;</H3> <H3 id="h.o8s0ol44od6g" class="c7"><FONT face="trebuchet ms,geneva"><STRONG><FONT color="#FF6600"><SPAN class="c11">Customer Infrastructure</SPAN><SPAN class="c11 c29">&nbsp;Setup</SPAN></FONT></STRONG></FONT></H3> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c2">If a customer infrastructure installation of Anything LLM is preferred over use of the Anything LLM cloud service, install Anything LLM on a host running:</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <UL class="c4 lst-kix_t39c5jav7uwu-0 start"> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Linux</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Windows</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Mac</SPAN></FONT></LI> </UL> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c2">For testing and development, a typical desktop or server system with 16GB RAM is able to run the Llama 3.2 11 billion parameter and similar small models in 12-14 GB RAM but is relatively slow at answering questions using only a CPU.</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c2">For production use, a GPU-based system with sufficient VRAM for your LLM model is recommended. &nbsp;For example, the Llama 3.3 70 billion parameter model requires a GPU with 32 - 64 GB of VRAM. &nbsp;Below examples of cloud instances and server hardware that support 70 billion and larger models:</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <UL class="c4 lst-kix_yzxwiw5yh6m7-0 start"> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c11">Google GCP:<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">A2</SPAN></STRONG><SPAN class="c2">&nbsp;with NVIDIA A100 GPU with 40 or 80 GB VRAM</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c11">Amazon AWS:<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">P4d</SPAN></STRONG><SPAN class="c11">&nbsp;or<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">P4de</SPAN></STRONG><SPAN class="c2">&nbsp;NVIDIA A100 GPU with 40 or 80 GB VRAM</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">NVIDIA Project DIGITS: Small desktop with GraceBlackwell CPU/GPU with 128 GB Unified RAM/VRAM (supports up to 200 billion parameter models, ~$3,000, available Q2 2024)</SPAN></FONT></LI> </UL> <H3 class="c7">&nbsp;</H3> <H3 id="h.lvsav03al0mp" class="c7"><FONT face="trebuchet ms,geneva" color="#FF6600"><STRONG><SPAN class="c11">Anything LLM and XSOAR&nbsp;</SPAN><SPAN class="c29 c11">Integration Instance Configuration</SPAN></STRONG></FONT></H3> <P class="c1">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Once Anything LLM is available, create an instance of the AnythingLLM integration:</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <UL class="c4 lst-kix_aw9yy6mm368h-0 start"> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">In Anything LLM:</SPAN></FONT> <UL> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva">Generate an API key for the XSOAR integration (<STRONG><SPAN class="c10">Developer API</SPAN></STRONG><SPAN class="c2">&nbsp;menu option).</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva">Activate selected LLM model (<STRONG><SPAN class="c10">LLM</SPAN></STRONG><SPAN class="c2"><STRONG>&nbsp;</STRONG>menu option).</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva">Activate selected vector database (<STRONG><SPAN class="c10">Vector Database</SPAN></STRONG><SPAN class="c2">&nbsp;menu option).</SPAN></FONT></LI> </UL> </LI> </UL> <P class="c1 c15">&nbsp;</P> <DIV id="tinyMceEditorRPrasadi_3" class="mceNonEditable lia-copypaste-placeholder">&nbsp;</DIV> <FONT face="trebuchet ms,geneva"><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="image4.jpg" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/65858iB29E8138D296F45D/image-size/large?v=v2&amp;px=999" role="button" title="image4.jpg" alt="image4.jpg" /></span></FONT> <P><FONT face="trebuchet ms,geneva" color="#FF6600"><SPAN class="c2">Figure 02 AnythingLLMapiKey_PaloAltoNetworks</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <DIV id="tinyMceEditorRPrasadi_4" class="mceNonEditable lia-copypaste-placeholder">&nbsp;</DIV> <FONT face="trebuchet ms,geneva"><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="image7.jpg" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/65860i73B2EDBA5F8BC59E/image-size/large?v=v2&amp;px=999" role="button" title="image7.jpg" alt="image7.jpg" /></span></FONT> <P><FONT face="trebuchet ms,geneva" color="#FF6600"><SPAN class="c2">Figure 03 AnythingLLMproviders_PaloAltoNetworks</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c11">Below is an example of Ollama installed on customer infrastructure and LLM models downloaded by Ollama. &nbsp;The context window is configured to 32,768 tokens (~64K characters +|-) &nbsp;for the<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">llama3.2-vision</SPAN></STRONG><SPAN class="c11">&nbsp;11 billion parameter model which provides an 8K - 128K token context window size. &nbsp;8K or 128K are the context sizes available when using the<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">AnythingLLM</SPAN></STRONG><SPAN class="c11">&nbsp;LLM provider and a llama model provided there. &nbsp;Using the<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">Ollama</SPAN></STRONG><SPAN class="c2">&nbsp;LLM provider allows control of the context window size. 8K is typically too small for XSOAR related data.</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva">&nbsp;</FONT></P> <DIV id="tinyMceEditorRPrasadi_5" class="mceNonEditable lia-copypaste-placeholder">&nbsp;</DIV> <FONT face="trebuchet ms,geneva"><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="image9.jpg" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/65861i966DD4CCF671E258/image-size/large?v=v2&amp;px=999" role="button" title="image9.jpg" alt="image9.jpg" /></span></FONT> <P><FONT face="trebuchet ms,geneva" color="#FF6600"><SPAN class="c2">Figure 04 AnythingLLMwithOllama_PaloAltoNetworks</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <UL class="c4 lst-kix_aw9yy6mm368h-0"> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">In XSOAR:&nbsp;</SPAN></FONT> <UL> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Configure the XSOAR integration instance with the Anything LLM url and api key.</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">If required, Cloudflare access can also be configured.</SPAN></FONT></LI> </UL> </LI> </UL> <P class="c1 c15">&nbsp;</P> <DIV id="tinyMceEditorRPrasadi_6" class="mceNonEditable lia-copypaste-placeholder">&nbsp;</DIV> <FONT face="trebuchet ms,geneva"><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="image10.jpg" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/65862i6C5893C846948C1F/image-size/large?v=v2&amp;px=999" role="button" title="image10.jpg" alt="image10.jpg" /></span></FONT> <P><FONT face="trebuchet ms,geneva" color="#FF6600"><SPAN class="c2">Figure 05 AnythingLLMconfig_PaloAltoNetworks</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <H2 id="h.r7wcfx22qxl2" class="c42 c33"><FONT face="trebuchet ms,geneva"><STRONG><FONT color="#FF6600"><SPAN class="c41 c11 c25">Use Case Development</SPAN></FONT></STRONG></FONT></H2> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c11">The Anything LLM content pack provides an interactive environment for data and prompt engineering for developing the steps needed to automate a use case. &nbsp;Create a new incident of type<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">AI Playground</SPAN></STRONG><SPAN class="c11">. &nbsp;The layout provides two tabs:<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">Workspace and Document Management</SPAN></STRONG><SPAN class="c11">&nbsp;and<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">AI Playground</SPAN></STRONG><SPAN class="c2">&nbsp;for uploading and embedding documents into a workspace and developing the needed prompts and workspace settings (Mode, Temperature, Similarity, and TopN). &nbsp;Some use cases may just require RAG where a few, similar pieces of text are retrieved from embedded documents while other use cases may require additional text to be added to the context of an LLM conversation using text search capabilities. &nbsp;A sequence of prompts may be required to generate the final response.</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c2">The general use case development process is:</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <UL class="c4 lst-kix_us9y0ofaycab-0 start"> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c11">Create an incident with a type of<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">AI Playground.</SPAN></STRONG></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c11">Create a workspace and configure its settings (the<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">anyllm-workspace-new</SPAN></STRONG><SPAN class="c2">&nbsp;command creates a workspace).</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Upload and embed needed documents in the workspace.</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Develop and test prompts with augmented data as required.</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">similarity search of embedded documents.</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">text search of documents or data in XSOAR.</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Once the steps and desired results are achieved.</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">build the playbook and any scripts needed to automate the use case.</SPAN></FONT></LI> </UL> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c11">For the most accurate results,<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">query</SPAN></STRONG><SPAN class="c11">&nbsp;mode is recommended for most chats. &nbsp;This preloads the conversation context based on the initial query with similar results from documents embedded in a workspace. &nbsp;In a large document,<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">query</SPAN></STRONG><SPAN class="c11">&nbsp;mode may not ensure a complete answer depending on the number of times the query topic is mentioned in the embedded documents and limits on the number of returned similar results and text search data is included in the conversation. &nbsp;When all data needed for the response it is injected into the conversation and not dependent on embedded documents,<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">chat</SPAN></STRONG><SPAN class="c2">&nbsp;mode is used.</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c11">Text splitting and chunking can be adjusted from the defaults to better support a specific use case. &nbsp;Adjusting the<SPAN>&nbsp;</SPAN></SPAN><SPAN class="c10">similarityThreshold</SPAN><SPAN class="c11">&nbsp;and<SPAN>&nbsp;</SPAN></SPAN><SPAN class="c10">topN</SPAN><SPAN class="c2">&nbsp;settings in a workspace are often beneficial to optimize the workspace for an use case.</SPAN></FONT></P> <H3 class="c7">&nbsp;</H3> <H3 id="h.fr8ox5kjsowk" class="c7"><FONT face="trebuchet ms,geneva"><STRONG><FONT color="#FF6600"><SPAN class="c29 c11">Workspace and Document Management</SPAN></FONT></STRONG></FONT></H3> <P class="c1 c15">&nbsp;</P> <H4 id="h.lrbb1i4y6qmz" class="c1 c33"><FONT face="trebuchet ms,geneva"><STRONG><FONT color="#FF6600"><SPAN class="c10 c21 c45">Workspaces</SPAN></FONT></STRONG></FONT></H4> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c11">The<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">Workspace and Document Management</SPAN></STRONG><SPAN class="c11">&nbsp;tab of the incident layout enables management of workspaces and documents. The<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">Workspaces</SPAN></STRONG><SPAN class="c11">&nbsp;section lists the available workspaces and allows configuration of their settings and selecting the current workspace by editing the table and using the<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">Action</SPAN></STRONG><SPAN class="c11">&nbsp;option<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">Current</SPAN></STRONG><SPAN class="c2">&nbsp;to set the active workspace. &nbsp;</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <H4 id="h.z2aqf5tiekom" class="c1 c33"><FONT face="trebuchet ms,geneva"><STRONG><FONT color="#FF6600"><SPAN class="c10 c21">Workspace Embeddings</SPAN></FONT></STRONG></FONT></H4> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c11">For the current workspace, the list of embedded documents are displayed in the<SPAN>&nbsp;</SPAN></SPAN><SPAN class="c10"><STRONG>Workspace Embeddings</STRONG><SPAN>&nbsp;</SPAN></SPAN><SPAN class="c11">section. The<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">Action</SPAN></STRONG><SPAN class="c11">&nbsp;options there are to<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">Remove</SPAN></STRONG><SPAN class="c11">&nbsp;the embedded document,<SPAN>&nbsp;</SPAN></SPAN><SPAN class="c10">Pin</SPAN><SPAN class="c11">&nbsp;the embedded document to the workspace adding all the content to the conversation context, and<SPAN>&nbsp;</SPAN></SPAN><SPAN class="c10">Unpin</SPAN><SPAN class="c2">&nbsp;the embedded document from the conversation. Care must be taken to not consume all the context space by pinning a large document.</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c11">Similarity search of an embedded document returns only the top chunks based on distance (cosine similarity) from the embedded form of the query - like the distance between two points in 3 dimensional space. &nbsp;In<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">query</SPAN></STRONG><SPAN class="c11">&nbsp;mode when using the<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">anyllm-workspace-thread-chat</SPAN></STRONG><SPAN class="c11">&nbsp;command, if 0 results are returned from the similarity search of the vector database, the query is aborted with “no relevant documentation” message. You may still get incorrect results if similarity search returns results and there is related information the model was trained on. &nbsp;Prompt and data engineering addresses this as well as adding text search results to the conversation context to supplement. &nbsp;In<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">chat</SPAN></STRONG><SPAN class="c2">&nbsp;mode, the prompt may include results from a similarity search but does not require it.</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <H4 id="h.ik9nc0rs8tiy" class="c1 c33"><FONT face="trebuchet ms,geneva"><STRONG><FONT color="#FF6600"><SPAN class="c10 c21">Documents</SPAN></FONT></STRONG></FONT></H4> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c11">The<SPAN>&nbsp;</SPAN></SPAN><SPAN class="c10">Documents</SPAN><SPAN class="c11">&nbsp;section displays all the documents uploaded into Anything LLM available for embedding in a workspace. The available<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">Action</SPAN></STRONG><SPAN class="c11">&nbsp;options are<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">Embed</SPAN></STRONG><SPAN class="c11">&nbsp;to embed the document into the current workspace, or<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">Delete</SPAN></STRONG><SPAN class="c2">&nbsp;to delete the document from the catalog.</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c11">Documents with a<SPAN>&nbsp;</SPAN></SPAN><SPAN class="c10">Title</SPAN><SPAN class="c11">&nbsp;prefixed by an XSOAR war room file entry ID were made text searchable by first uploading them to the war room and then use of the<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">Process War Room Text File Entry for Upload</SPAN></STRONG><SPAN class="c11">&nbsp;button to preprocess the document, followed by the<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">Upload Processed Information as LLM Document</SPAN></STRONG><SPAN class="c2">&nbsp;button. &nbsp;</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c11">XSOAR search results from the<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">AI Playground</SPAN></STRONG><SPAN class="c11">&nbsp;can be processed and uploaded using the<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">Process Search Results for Upload</SPAN></STRONG><SPAN class="c11">&nbsp;button followed by the<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">Upload Processed Information as LLM Document</SPAN></STRONG><SPAN class="c11">&nbsp;button. &nbsp;External text can also be uploaded as a searchable LLM document using the same process with the<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">Process Text for Upload</SPAN></STRONG><SPAN class="c11">&nbsp;button. In version 2.0 of the content pack, the<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">Process Web Link for Upload</SPAN></STRONG><SPAN class="c11">&nbsp;button uploads the document to the catalog for embedding, but not as a searchable document.</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Documents specific to an investigation are added to the investigation's war room and uploaded to the LLM. Documents that apply to multiple investigations, to retain their searchability, a dedicated incident is created and the documents uploaded to that war room. &nbsp;These incidents should be flagged for long term retention since their XSOAR file entry ID is associated with the investigation IDs and stored in Anything LLM as the document’s title. As an example, Mitre ATT&amp;CK documentation is uploaded to an incident dedicated to retaining them as searchable and embeddable documents across many investigations.</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <DIV id="tinyMceEditorRPrasadi_7" class="mceNonEditable lia-copypaste-placeholder">&nbsp;</DIV> <FONT face="trebuchet ms,geneva"><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="image11.jpg" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/65863iE5E1EECF4A9EDC66/image-size/large?v=v2&amp;px=999" role="button" title="image11.jpg" alt="image11.jpg" /></span></FONT> <P><FONT face="trebuchet ms,geneva" color="#FF6600"><SPAN class="c2">Figure 06 WorkspaceAndDocumentManagement_PaloAltoNetworks</SPAN></FONT></P> <H3 class="c7">&nbsp;</H3> <H3 id="h.oasv1tg2qwp" class="c7"><FONT face="trebuchet ms,geneva" color="#FF6600"><SPAN class="c29 c11">AI Playground</SPAN></FONT></H3> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c11">The<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">AI Playground</SPAN></STRONG><SPAN class="c11">&nbsp;tab is used to develop prompts against a workspace and its embedded documents with additional text from LLM documents or XSOAR using the<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">Text Search...</SPAN></STRONG><SPAN class="c11">&nbsp;buttons. &nbsp;Useful search results are added to the conversation context with the<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">Add Search Results to Conversation</SPAN></STRONG><SPAN class="c11">&nbsp;button. &nbsp;A valuable conversation is saved to the war room with the<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">Save Conversation to the War Room</SPAN></STRONG><SPAN class="c2">&nbsp;button. &nbsp;</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <DIV id="tinyMceEditorRPrasadi_8" class="mceNonEditable lia-copypaste-placeholder">&nbsp;</DIV> <FONT face="trebuchet ms,geneva"><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="image6.jpg" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/65864iBAD280707AA51B9C/image-size/large?v=v2&amp;px=999" role="button" title="image6.jpg" alt="image6.jpg" /></span></FONT> <P><FONT face="trebuchet ms,geneva" color="#FF6600"><SPAN class="c2">Figure 07 AIplayground_PaloAltoNetworks</SPAN></FONT></P> <P class="c19">&nbsp;</P> <H3 id="h.r4nhp6gvjiw8" class="c7"><FONT face="trebuchet ms,geneva"><STRONG><FONT color="#FF6600"><SPAN class="c29 c11">General Tips and Guidance</SPAN></FONT></STRONG></FONT></H3> <P class="c1 c15">&nbsp;</P> <UL class="c4 lst-kix_wuq5rysqxhy5-0 start"> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Clean uploaded documentation from extraneous text (ie: HTML and PDF formatting and page footers/headers etc.) when embedding a document since data is returned in 1,000 character chunks to ensure data being searched for is retrieved. Extraneous text may cause chunks to be returned that do not contain the data needed.</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">In a workspace, only embed the documents needed for the use case. &nbsp;It may be advantageous to create a workspace for an investigation, dynamically embed needed documents, then delete the workspace at incident closure.</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Depending on the LLM model used, asking three precise questions about A, then B, then C, may give better results than one question about A and B and C. Once the three questions are asked and results in the conversation context, asking the final question with all three intermediate results may be more effective.</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Once a partial result is achieved and the full conversation context is no longer needed for subsequent questions, start a new conversation thread with no context. Keeping the context small and focused increases speed and accuracy of responses.</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">An incorrect response in the conversation context pollutes subsequent results. Testing and tuning your approach prevents this.</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c11">Setting the workspace<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">Temperature</SPAN></STRONG><SPAN class="c2">&nbsp;to the lowest value supported by your LLM model provides the most deterministic results.</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c11">If similarity search is not returning the correct results, review the number of chunks being returned. If too few chunks, increase the<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">Top N</SPAN></STRONG><SPAN class="c11">&nbsp;setting or reduce the<SPAN>&nbsp;</SPAN></SPAN><SPAN class="c10">Similarity</SPAN><SPAN class="c11">&nbsp;setting. &nbsp;If too many chunks are returned without the correct data, increase the<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">Similarity</SPAN></STRONG><SPAN class="c2">&nbsp;setting. &nbsp;This is where clean documented supports providing the correct results.</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Be aware of the context window size of your LLM model and how it relates to the data you are adding to the conversation context either via similarity search, text search, or pinning an embedded document to a workspace. Filling the context window causes the prompt to fail or rolls data off from the beginning of the conversation.</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Context windows are usually specified in tokens and each token may be a character or a part of a word, or a word in size. An 8K context window supports approximately 16K characters, which varies depending on the tokens used.</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c2">Large context windows increases memory requirements and the time it takes to answer a question and may reduce accuracy when large amount of data are in the conversation context.</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c11">When searching structured text like YAML or JSON where you need only a small set of lines, a regex pattern such as &nbsp;</SPAN><STRONG><SPAN class="c10">(?s)\d(?&lt;=[\d\[\].])(.*?:TLS)</SPAN></STRONG><SPAN class="c2">&nbsp; &nbsp;helps minimize text added to the conversation context. This is a simple pattern example to: find all the lines starting with either a defanged IP or domain and finishing with a line containing ":TLS".</SPAN></FONT></LI> </UL> <H3 id="h.bbksabyglfjz" class="c7 c14">&nbsp;</H3> <H3 id="h.8f6tkdtr3hx" class="c7"><FONT face="trebuchet ms,geneva"><STRONG><FONT color="#FF6600"><SPAN class="c29 c11">Example Scripts Using the Anything LLM Integration</SPAN></FONT></STRONG></FONT></H3> <P class="c1 c15">&nbsp;</P> <H4 id="h.4pudzww4ls54" class="c1 c33"><FONT face="trebuchet ms,geneva"><STRONG><FONT color="#FF6600"><SPAN class="c10 c21">Summarize an Investigation</SPAN></FONT></STRONG></FONT></H4> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c11">Below is an example script to summarize an investigation by looking at the sequential order of completed tasks and summarizing each task executed. &nbsp;It uses<STRONG>&nbsp;</STRONG></SPAN><STRONG><SPAN class="c10">chat</SPAN></STRONG><SPAN class="c11">&nbsp;mode since all the data is being provided dynamically from XSOAR versus data from an embedded document. &nbsp;In addition to the investigation<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">id</SPAN></STRONG><SPAN class="c11">&nbsp;and<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">workspace</SPAN></STRONG><SPAN class="c11">&nbsp;name arguments, the following<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">question</SPAN></STRONG><SPAN class="c2">&nbsp;is passed as an argument:</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <P class="c1 c24"><FONT face="trebuchet ms,geneva"><SPAN class="c11 c17">Summarize the task in the following JSON. Please include name, start, and completed dates, description and script and script arguments for each task. If it is a condition task, only tell me what branch it took</SPAN><SPAN class="c11 c39">.</SPAN></FONT></P> <P class="c1 c15 c24">&nbsp;</P> <DIV id="tinyMceEditorRPrasadi_9" class="mceNonEditable lia-copypaste-placeholder">&nbsp;</DIV> <FONT face="trebuchet ms,geneva"><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="image5.jpg" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/65865i3C742E05C550B371/image-size/large?v=v2&amp;px=999" role="button" title="image5.jpg" alt="image5.jpg" /></span></FONT> <P><FONT face="trebuchet ms,geneva" color="#FF6600"><SPAN class="c2">Figure 08 SummarizeInvestigation_PaloAltoNetworks</SPAN></FONT></P> <P class="c1 c15"><FONT face="trebuchet ms,geneva">&nbsp;</FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">import collections</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">import uuid</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">def main():</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; try:</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; incid = demisto.args().get("id", "")</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; workspace = demisto.args().get("workspace", "")</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; question = demisto.args().get("question", "")</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c9">&nbsp; &nbsp; &nbsp; &nbsp; if<SPAN>&nbsp;</SPAN></SPAN><SPAN class="c9">incid</SPAN><SPAN class="c8">&nbsp;== "" or workspace == "" or question == "":</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; resp = execute_command("core-api-get", {</SPAN></FONT></P> <P class="c1 c20"><FONT face="trebuchet ms,geneva"><SPAN class="c8">"uri": f"/inv-playbook/{incid}"</SPAN></FONT></P> <P class="c1 c24"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp;})</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; tasks = {}</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; for k, t in resp['response']['tasks'].items():</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if t['type'].lower() in ["regular", "condition", "playbook"]</SPAN></FONT></P> <P class="c1 c12"><FONT face="trebuchet ms,geneva"><SPAN class="c8">and t['state'].lower() == "completed":</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; tasks[t['completedDate']] = t</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; sortedtasks = collections.OrderedDict(sorted(tasks.items()))</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; results = ""</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; for k, v in sortedtasks.items():</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; thread_uuid = str(uuid.uuid4())</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; execute_command("anyllm-workspace-thread-new", {</SPAN></FONT></P> <P class="c1 c12"><FONT face="trebuchet ms,geneva"><SPAN class="c8">'workspace': workspace,</SPAN></FONT></P> <P class="c1 c12"><FONT face="trebuchet ms,geneva"><SPAN class="c8">'thread': thread_uuid</SPAN></FONT></P> <P class="c1 c56"><FONT face="trebuchet ms,geneva"><SPAN class="c8">})</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; prompt = f"{question}: {json.dumps(v)}"</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; results += f"\n{execute_command('anyllm-workspace-thread-chat', {</SPAN></FONT></P> <P class="c1 c12"><FONT face="trebuchet ms,geneva"><SPAN class="c8">'message': prompt,</SPAN></FONT></P> <P class="c1 c12"><FONT face="trebuchet ms,geneva"><SPAN class="c8">'mode': 'chat',</SPAN></FONT></P> <P class="c1 c12"><FONT face="trebuchet ms,geneva"><SPAN class="c8">'workspace': workspace,</SPAN></FONT></P> <P class="c1 c12"><FONT face="trebuchet ms,geneva"><SPAN class="c8">'thread': thread_uuid</SPAN></FONT></P> <P class="c1 c24"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; })['textResponse']}\n"</SPAN></FONT></P> <P class="c1 c15 c24">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; execute_command("anyllm-workspace-thread-delete", {</SPAN></FONT></P> <P class="c1 c12"><FONT face="trebuchet ms,geneva"><SPAN class="c8">'workspace': workspace,</SPAN></FONT></P> <P class="c1 c12"><FONT face="trebuchet ms,geneva"><SPAN class="c8">'thread': thread_uuid</SPAN></FONT></P> <P class="c1 c24"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; })</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; return_results(CommandResults(readable_output=results))</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; except Exception as ex:</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; if thread_uuid != "":</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; execute_command("anyllm-workspace-thread-delete", {</SPAN></FONT></P> <P class="c1 c12"><FONT face="trebuchet ms,geneva"><SPAN class="c8">'workspace': workspace,</SPAN></FONT></P> <P class="c1 c12"><FONT face="trebuchet ms,geneva"><SPAN class="c8">'thread': thread_uuid</SPAN></FONT></P> <P class="c1 c24"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp;})</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; demisto.error(traceback.format_exc())</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; return_error(f'Failed to execute SummarizeInvestigation. Error: {ex}')</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">if __name__ in ('__main__', '__builtin__', 'builtins'):</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; main()</SPAN></FONT></P> <H4 id="h.8t7uej2yivcz" class="c1 c33 c44">&nbsp;</H4> <H4 id="h.pzbktj60at3p" class="c1 c33"><FONT face="trebuchet ms,geneva"><STRONG><FONT color="#FF6600"><SPAN class="c10 c21">XSOAR Natural Language Command Interface</SPAN></FONT></STRONG></FONT></H4> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c11">This script uses a sequence of prompts to the LLM and an embedded implementation of the Anything XSOAR integration code. The first two prompts use<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">query</SPAN></STRONG><SPAN class="c11">&nbsp;mode to retrieve the appropriate command name and then a JSON template of the command parameters. &nbsp;The final<SPAN>&nbsp;</SPAN></SPAN><SPAN class="c10">chat</SPAN><SPAN class="c11">&nbsp;mode prompt uses the parameters template and the<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">parameters</SPAN></STRONG><SPAN class="c11">&nbsp;argument to populate a python dictionary that is passed to<STRONG>&nbsp;</STRONG></SPAN><STRONG><SPAN class="c10">execute_command()</SPAN><SPAN class="c2">.</SPAN></STRONG></FONT></P> <P class="c1 c15">&nbsp;</P> <DIV id="tinyMceEditorRPrasadi_10" class="mceNonEditable lia-copypaste-placeholder">&nbsp;</DIV> <FONT face="trebuchet ms,geneva"><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="image8.jpg" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/65866i2FB3E0B8C7015F9C/image-size/large?v=v2&amp;px=999" role="button" title="image8.jpg" alt="image8.jpg" /></span></FONT> <P><FONT face="trebuchet ms,geneva" color="#FF6600"><SPAN class="c2">Figure 09 NaturalLanguageCommandInterface_PaloAltoNetworks</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">import collections</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">import uuid</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">def main():</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; try:</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; workspace = demisto.args().get("workspace", "")</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c9">&nbsp; &nbsp; &nbsp; &nbsp;<SPAN>&nbsp;</SPAN></SPAN><SPAN class="c9">cmddesc</SPAN><SPAN class="c8">&nbsp;= demisto.args().get("command", "")</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c9">&nbsp; &nbsp; &nbsp; &nbsp;<SPAN>&nbsp;</SPAN></SPAN><SPAN class="c9">argdesc</SPAN><SPAN class="c8">&nbsp;= demisto.args().get("parameters", "")</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c9">&nbsp; &nbsp; &nbsp; &nbsp; if workspace == "" or<SPAN>&nbsp;</SPAN></SPAN><SPAN class="c9">cmddesc</SPAN><SPAN class="c8">&nbsp;== "":</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; thread_uuid = str(uuid.uuid4())</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; execute_command("anyllm-workspace-thread-new", {</SPAN></FONT></P> <P class="c1 c20"><FONT face="trebuchet ms,geneva"><SPAN class="c8">'workspace': workspace,</SPAN></FONT></P> <P class="c1 c20"><FONT face="trebuchet ms,geneva"><SPAN class="c8">'thread': thread_uuid</SPAN></FONT></P> <P class="c1 c24"><FONT face="trebuchet ms,geneva"><SPAN class="c8">})</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; command = execute_command('anyllm-workspace-thread-chat', {</SPAN></FONT></P> <P class="c1 c20"><FONT face="trebuchet ms,geneva"><SPAN class="c9">'message': f"{</SPAN><SPAN class="c9">cmddesc</SPAN><SPAN class="c8">}. Return only the command name",</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'mode': 'query',</SPAN></FONT></P> <P class="c1 c20"><FONT face="trebuchet ms,geneva"><SPAN class="c8">'workspace': workspace,</SPAN></FONT></P> <P class="c1 c20"><FONT face="trebuchet ms,geneva"><SPAN class="c8">'thread': thread_uuid</SPAN></FONT></P> <P class="c1 c24"><FONT face="trebuchet ms,geneva"><SPAN class="c8">})['textResponse']</SPAN></FONT></P> <P class="c1 c15 c24">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp;arguments = execute_command('anyllm-workspace-thread-chat', {</SPAN></FONT></P> <P class="c1 c20"><FONT face="trebuchet ms,geneva"><SPAN class="c8">'message': f"How would I invoke {command} with the python function execute_command(command, parameters)? Return only the the python dictionary for the parameters",</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'mode': 'query',</SPAN></FONT></P> <P class="c1 c20"><FONT face="trebuchet ms,geneva"><SPAN class="c8">'workspace': workspace,</SPAN></FONT></P> <P class="c1 c20"><FONT face="trebuchet ms,geneva"><SPAN class="c8">'thread': thread_uuid</SPAN></FONT></P> <P class="c1 c24"><FONT face="trebuchet ms,geneva"><SPAN class="c8">})['textResponse']</SPAN></FONT></P> <P class="c1 c15 c24">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c9">&nbsp; &nbsp; &nbsp; &nbsp;<SPAN>&nbsp;</SPAN></SPAN><SPAN class="c9">argjson</SPAN><SPAN class="c8">&nbsp;= execute_command('anyllm-workspace-thread-chat', {</SPAN></FONT></P> <P class="c1 c20"><FONT face="trebuchet ms,geneva"><SPAN class="c9">'message': f"Use the following data: \"{</SPAN><SPAN class="c9">argdesc</SPAN><SPAN class="c8">}\" as values to create a python dictionary using these keys: {arguments}. Return only the python dictionary with the new key values set as a JSON string",</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'mode': 'chat',</SPAN></FONT></P> <P class="c1 c20"><FONT face="trebuchet ms,geneva"><SPAN class="c8">'workspace': workspace,</SPAN></FONT></P> <P class="c1 c20"><FONT face="trebuchet ms,geneva"><SPAN class="c8">'thread': thread_uuid</SPAN></FONT></P> <P class="c1 c24"><FONT face="trebuchet ms,geneva"><SPAN class="c8">})['textResponse']</SPAN></FONT></P> <P class="c1 c15 c24">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c9">&nbsp; &nbsp; &nbsp; &nbsp; argsdict = json.loads(</SPAN><SPAN class="c9">argjson</SPAN><SPAN class="c8">)</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; argsdict['workspace'] = workspace</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; argsdict['thread'] = thread_uuid</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; results = execute_command(command, argsdict)['textResponse']</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; execute_command("anyllm-workspace-thread-delete", {</SPAN></FONT></P> <P class="c1 c20"><FONT face="trebuchet ms,geneva"><SPAN class="c8">'workspace': workspace,</SPAN></FONT></P> <P class="c1 c20"><FONT face="trebuchet ms,geneva"><SPAN class="c8">'thread': thread_uuid</SPAN></FONT></P> <P class="c1 c24"><FONT face="trebuchet ms,geneva"><SPAN class="c8">})</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; return_results(CommandResults(readable_output=results))</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; except Exception as ex:</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; demisto.error(traceback.format_exc())</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; if thread_uuid != "":</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; execute_command("anyllm-workspace-thread-delete", {</SPAN></FONT></P> <P class="c1 c20"><FONT face="trebuchet ms,geneva"><SPAN class="c8">'workspace': workspace, 'thread': thread_uuid})</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; return_error(f'Failed to execute IntegrationNLC. Error: {ex}')</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">if __name__ in ('__main__', '__builtin__', 'builtins'):</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; main()</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <H4 id="h.aoxyq3dta8kr" class="c1 c33"><FONT face="trebuchet ms,geneva"><STRONG><FONT color="#FF6600"><SPAN class="c45 c37 c55">XSOAR Natural Language Search</SPAN></FONT></STRONG></FONT></H4> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c11">This script illustrates how to perform natural language search of XSOAR incidents. &nbsp;It uses<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">chat</SPAN></STRONG><SPAN class="c11">&nbsp;mode LLM queries since it does not require RAG; the parameters to<SPAN>&nbsp;</SPAN></SPAN><STRONG><SPAN class="c10">getIncidents</SPAN></STRONG><SPAN class="c2">&nbsp;are included in the script as a python dictionary.</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <DIV id="tinyMceEditorRPrasadi_11" class="mceNonEditable lia-copypaste-placeholder">&nbsp;</DIV> <FONT face="trebuchet ms,geneva"><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="image12.jpg" style="width: 999px;"><img src="https://live.paloaltonetworks.com/t5/image/serverpage/image-id/65867iB954E328FD210504/image-size/large?v=v2&amp;px=999" role="button" title="image12.jpg" alt="image12.jpg" /></span></FONT> <P><FONT face="trebuchet ms,geneva" color="#FF6600"><SPAN class="c2">Figure 10 NaturalLanguageSearch_PaloAltoNetworks</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">import collections</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">import uuid</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">searchArgs = {</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; 'page': "Filter by the page number",</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; 'size': "Filter by the page size (per fetch)",</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; 'sort': "",</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; 'id': "Filter by the incident IDs",</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; 'name': "Filter by incident names",</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; 'status': "Filter by the status. Pending (0), Active (1), Done (2), Archive (3)",</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; 'notstatus': "Negate status (e.g. get only incidents that do not have the status of active)",</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; 'reason': "Filter by closure reason",</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c9">&nbsp; &nbsp; '</SPAN><SPAN class="c9">fromdate</SPAN><SPAN class="c8">': "Filter by from date (e.g. 2006-01-02T15:04:05+07:00)",</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; 'todate': "Filter by to date (e.g. 2016-01-02T15:04:05+07:00)",</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; 'fromclosedate': "Filter by the incident close date, from",</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; 'toclosedate': "Filter by the incident to close date, to",</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; 'fromduedate': "Filter by SLA due date, from",</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; 'toduedate': "Filter by SLA due date, to",</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; 'level': "Filter by Severity. Unknown (0), Informational (0.5), Low (1), Medium (2), High (3), Critical (4)",</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; 'investigation': "",</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; 'owner': "Filter by incident owners",</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; 'details': "Filter by incident details",</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; 'type': "Filter by incident type",</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; 'query': "Use free form query (use Lucene syntax) as filter. All other filters will be ignored when this filter is used",</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; 'searchInNotIndexed': "Also search for incidents that have not yet been indexed",</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; 'populateFields': "A comma-separated list of fields and custom fields in the object to populate"</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; }</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">def main():</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; try:</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; workspace = demisto.args().get("workspace", "")</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c9">&nbsp; &nbsp; &nbsp; &nbsp;<SPAN>&nbsp;</SPAN></SPAN><SPAN class="c9">argdesc</SPAN><SPAN class="c8">&nbsp;= demisto.args().get("parameters", "")</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c9">&nbsp; &nbsp; &nbsp; &nbsp; if workspace == "" or<SPAN>&nbsp;</SPAN></SPAN><SPAN class="c9">argdesc</SPAN><SPAN class="c8">&nbsp;== "":</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; thread_uuid = str(uuid.uuid4())</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; execute_command("anyllm-workspace-thread-new", {</SPAN></FONT></P> <P class="c1 c20"><FONT face="trebuchet ms,geneva"><SPAN class="c8">'workspace': workspace,</SPAN></FONT></P> <P class="c1 c20"><FONT face="trebuchet ms,geneva"><SPAN class="c8">'thread': thread_uuid</SPAN></FONT></P> <P class="c1 c24"><FONT face="trebuchet ms,geneva"><SPAN class="c8">})</SPAN></FONT></P> <P class="c1 c15 c24">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; execute_command('anyllm-workspace-thread-chat', {</SPAN></FONT></P> <P class="c1 c20"><FONT face="trebuchet ms,geneva"><SPAN class="c8">'message': f"Here are the \"getIncidents\" command's arguments as a python dictionary in JSON: {json.dumps(searchArgs)}. &nbsp;Use this to create a python dictionary for the arguments to \"getIncidents\" ",</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'mode': 'chat',</SPAN></FONT></P> <P class="c1 c20"><FONT face="trebuchet ms,geneva"><SPAN class="c8">'workspace': workspace,</SPAN></FONT></P> <P class="c1 c20"><FONT face="trebuchet ms,geneva"><SPAN class="c8">'thread': thread_uuid</SPAN></FONT></P> <P class="c1 c24"><FONT face="trebuchet ms,geneva"><SPAN class="c8">})</SPAN></FONT></P> <P class="c1 c15 c24">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c9">&nbsp; &nbsp; &nbsp; &nbsp;<SPAN>&nbsp;</SPAN></SPAN><SPAN class="c9">argjson</SPAN><SPAN class="c8">&nbsp;= execute_command('anyllm-workspace-thread-chat', {</SPAN></FONT></P> <P class="c1 c20"><FONT face="trebuchet ms,geneva"><SPAN class="c9">'message': f"Use the following data: \"{</SPAN><SPAN class="c9">argdesc</SPAN><SPAN class="c8">}\" as values to create the python dictionary for the \"getIncidents\" command's arguments. Leave out any missing values. Return only the arguments python dictionary as a JSON string",</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;'mode': 'chat',</SPAN></FONT></P> <P class="c1 c20"><FONT face="trebuchet ms,geneva"><SPAN class="c8">'workspace': workspace,</SPAN></FONT></P> <P class="c1 c56"><FONT face="trebuchet ms,geneva"><SPAN class="c8">'thread': thread_uuid</SPAN></FONT></P> <P class="c1 c46"><FONT face="trebuchet ms,geneva"><SPAN class="c8">})['textResponse']</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c9">&nbsp; &nbsp; &nbsp; &nbsp; argsdict = json.loads(</SPAN><SPAN class="c9">argjson</SPAN><SPAN class="c8">)</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; results = execute_command("getIncidents", argsdict)</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp;</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; execute_command("anyllm-workspace-thread-delete", {</SPAN></FONT></P> <P class="c1 c20"><FONT face="trebuchet ms,geneva"><SPAN class="c8">'workspace': workspace,</SPAN></FONT></P> <P class="c1 c20"><FONT face="trebuchet ms,geneva"><SPAN class="c8">'thread': thread_uuid</SPAN></FONT></P> <P class="c1 c24"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp;})</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; return_results(CommandResults(readable_output=results))</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; except Exception as ex:</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; demisto.error(traceback.format_exc())</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; if thread_uuid != "":</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; execute_command("anyllm-workspace-thread-delete", {</SPAN></FONT></P> <P class="c1 c20"><FONT face="trebuchet ms,geneva"><SPAN class="c8">'workspace': workspace,</SPAN></FONT></P> <P class="c1 c20"><FONT face="trebuchet ms,geneva"><SPAN class="c8">'thread': thread_uuid</SPAN></FONT></P> <P class="c1 c24"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp;})</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; &nbsp; &nbsp; return_error(f'Failed to execute SearchIncidentsNLC. Error: {ex}')</SPAN></FONT></P> <P class="c1 c15">&nbsp;</P> <P class="c1 c15">&nbsp;</P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">if __name__ in ('__main__', '__builtin__', 'builtins'):</SPAN></FONT></P> <P class="c1"><FONT face="trebuchet ms,geneva"><SPAN class="c8">&nbsp; &nbsp; main()</SPAN></FONT></P> <H2 class="c42 c33">&nbsp;</H2> <H2 id="h.caxs5clltci7" class="c42 c33"><FONT face="trebuchet ms,geneva" color="#FF6600"><STRONG><SPAN class="c41 c11 c25">References</SPAN></STRONG></FONT></H2> <P class="c1 c15">&nbsp;</P> <UL class="c4 lst-kix_9qitoeo0az2-0 start"> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c34 c11"><A class="c13" href="https://www.google.com/url?q=https://cortex.marketplace.pan.dev/marketplace/details/AnythingLLM/&amp;sa=D&amp;source=editors&amp;ust=1738727259820424&amp;usg=AOvVaw2G8tGUMzEWiG924sC3VDhW" target="_blank" rel="noopener">Anything LLM | Marketplace</A></SPAN><SPAN class="c2">&nbsp;</SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c34 c11"><A class="c13" href="https://www.google.com/url?q=https://www.promptingguide.ai/introduction/settings&amp;sa=D&amp;source=editors&amp;ust=1738727259820638&amp;usg=AOvVaw2G91M6Xzc7SHHEX50aSIJW" target="_blank" rel="noopener">LLM Settings</A></SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c11 c34"><A class="c13" href="https://www.google.com/url?q=https://www.deeplearning.ai/&amp;sa=D&amp;source=editors&amp;ust=1738727259820760&amp;usg=AOvVaw21zFnYx0xXcZYq3WTSTwNu" target="_blank" rel="noopener">Deeplearrning.AI</A></SPAN></FONT></LI> <LI class="c1 c6 li-bullet-0"><FONT face="trebuchet ms,geneva"><SPAN class="c34 c11"><A class="c13" href="https://www.google.com/url?q=https://anythingllm.com/&amp;sa=D&amp;source=editors&amp;ust=1738727259820862&amp;usg=AOvVaw22HkNnVJRzVfUi8sZrtg8g" target="_blank" rel="noopener">AnythingLLM</A></SPAN></FONT></LI> </UL> <P class="c1 c15">&nbsp;</P> <P class="c1 c15">&nbsp;</P> <P class="c1 c15 c30">&nbsp;</P> <DIV> <P class="c1 c15 c38">&nbsp;</P> </DIV> </DIV> Thu, 06 Feb 2025 18:16:38 GMT RPrasadi 2025-02-06T18:16:38Z https://live.paloaltonetworks.com/t5/cortex-xsoar-articles/xsoar-with-generative-ai-and-retrieval-augmented-generation/ta-p/1219466 <P><FONT face="trebuchet ms,geneva"><SPAN class="c11">Use of Generative AI (GenAI) and Retrieval Augmented Generation (RAG) with XSOAR is provided by the Anything LLM marketplace content pack. Anything LLM can be cloud-based or to address privacy, compliance, and</SPAN><SPAN class="c11">&nbsp;cost requirements; it can be installed on customer infrastructure.</SPAN><SPAN class="c2">&nbsp; A large selection of LLM models and vector databases are available in Anything LLM and custom LLM models can be imported. &nbsp;</SPAN></FONT></P> Thu, 06 Feb 2025 18:16:38 GMT https://live.paloaltonetworks.com/t5/cortex-xsoar-articles/xsoar-with-generative-ai-and-retrieval-augmented-generation/ta-p/1219466 RPrasadi 2025-02-06T18:16:38Z https://live.paloaltonetworks.com/t5/cortex-xsoar-articles/xsoar-with-generative-ai-and-retrieval-augmented-generation/tac-p/1226914#M107 <P>This is very informative.</P><P>Thank you for sharing.</P><P>&nbsp;</P><P>&nbsp;</P> Sun, 20 Apr 2025 09:26:38 GMT https://live.paloaltonetworks.com/t5/cortex-xsoar-articles/xsoar-with-generative-ai-and-retrieval-augmented-generation/tac-p/1226914#M107 RayyanAlboqari 2025-04-20T09:26:38Z