feat: add debug logging for alert processing and related alerts retrieval

Author: yllada

soc-ai/elastic/alerts.go

@@ -74,6 +74,9 @@ type AlertCorrelation struct {
 }
 
 func GetRelatedAlerts() ([]schema.GPTAlertResponse, error) {
+	// Debug log
+	utils.Logger.Info("Getting historical alerts from Elasticsearch")
+
 	result, err := ElasticSearch(configurations.ALERT_INDEX_PATTERN, "*", "*")
 	if err != nil {
 		return nil, fmt.Errorf("error getting historical alerts: %v", err)
@@ -89,6 +92,9 @@ func GetRelatedAlerts() ([]schema.GPTAlertResponse, error) {
 }
 
 func FindRelatedAlerts(currentAlert schema.Alert) (*AlertCorrelation, error) {
+	// Debug log
+	utils.Logger.Info("Finding related alerts for alert %s", currentAlert.ID)
+
 	correlation := &AlertCorrelation{
 		CurrentAlert:    currentAlert,
 		RelatedAlerts:   []schema.Alert{},
@@ -100,6 +106,8 @@ func FindRelatedAlerts(currentAlert schema.Alert) (*AlertCorrelation, error) {
 		return nil, err
 	}
 
+	utils.Logger.Info("Found %d historical alerts to analyze", len(historicalResponses))
+
 	var alertIDs []string
 	for _, resp := range historicalResponses {
 		alertIDs = append(alertIDs, resp.ActivityID)
@@ -123,36 +131,50 @@ func FindRelatedAlerts(currentAlert schema.Alert) (*AlertCorrelation, error) {
 		}
 	}
 
+	utils.Logger.Info("Completed related alerts search. Found %d related alerts for ID: %s",
+		len(correlation.RelatedAlerts), currentAlert.ID)
+
 	return correlation, nil
 }
 
 func isAlertRelated(current, historical schema.Alert) bool {
+	utils.Logger.Info("Checking relation between alerts - Current: %s, Historical: %s", current.ID, historical.ID)
+
 	if current.Destination.IP != "" && current.Destination.IP == historical.Destination.IP {
+		utils.Logger.Info("Match found: Destination IP %s", current.Destination.IP)
 		return true
 	}
 	if current.Destination.Port != 0 && current.Destination.Port == historical.Destination.Port {
+		utils.Logger.Info("Match found: Destination Port %d", current.Destination.Port)
 		return true
 	}
 	if current.Destination.Host != "" && current.Destination.Host == historical.Destination.Host {
+		utils.Logger.Info("Match found: Destination Host %s", current.Destination.Host)
 		return true
 	}
 	if current.Destination.User != "" && current.Destination.User == historical.Destination.User {
+		utils.Logger.Info("Match found: Destination User %s", current.Destination.User)
 		return true
 	}
 
 	if current.Source.IP != "" && current.Source.IP == historical.Source.IP {
+		utils.Logger.Info("Match found: Source IP %s", current.Source.IP)
 		return true
 	}
 	if current.Source.Port != 0 && current.Source.Port == historical.Source.Port {
+		utils.Logger.Info("Match found: Source Port %d", current.Source.Port)
 		return true
 	}
 	if current.Source.Host != "" && current.Source.Host == historical.Source.Host {
+		utils.Logger.Info("Match found: Source Host %s", current.Source.Host)
 		return true
 	}
 	if current.Source.User != "" && current.Source.User == historical.Source.User {
+		utils.Logger.Info("Match found: Source User %s", current.Source.User)
 		return true
 	}
 
+	utils.Logger.Info("No match found between alerts %s and %s", current.ID, historical.ID)
 	return false
 }
 
@@ -194,12 +216,6 @@ func BuildCorrelationContext(correlation *AlertCorrelation) string {
 		if alert.Destination.Port != 0 {
 			context.WriteString(fmt.Sprintf("- Destination Port: %d\n", alert.Destination.Port))
 		}
-		if alert.Protocol != "" {
-			context.WriteString(fmt.Sprintf("- Protocol: %s\n", alert.Protocol))
-		}
-		if alert.Severity != 0 {
-			context.WriteString(fmt.Sprintf("- Severity: %d\n", alert.Severity))
-		}
 	}
 
 	return context.String()

soc-ai/gpt/client.go

@@ -58,14 +58,13 @@ func (c *GPTClient) Request(alert schema.AlertGPTDetails) (string, error) {
 		},
 	}
 
-	// Debug log
-	utils.Logger.Info("GPT Request: %s", req.Messages[0].Content)
-
 	requestJson, error := json.Marshal(req)
 	if error != nil {
 		return "", fmt.Errorf("error marshalling request: %v", error)
 	}
 
+	utils.Logger.Info("Complete GPT Request JSON: %s", string(requestJson))
+
 	headers := map[string]string{
 		"Authorization": "Bearer " + configurations.GetGPTConfig().APIKey,
 		"Content-Type":  "application/json",

soc-ai/processor/alertProcessor.go

@@ -10,11 +10,14 @@ import (
 
 func (p *Processor) processAlertsInfo() {
 	for alert := range p.AlertInfoQueue {
+		utils.Logger.Info("Processing alert info for ID: %s", alert.AlertID)
+
 		alertInfo, err := elastic.GetAlertsInfo(alert.AlertID)
 		if err != nil {
 			p.RegisterError(fmt.Sprintf("error while getting alert %s info: %v", alert.AlertID, err), alert.AlertID)
 			continue
 		}
+		utils.Logger.Info("Alert info retrieved successfully for ID: %s", alert.AlertID)
 
 		correlation, err := elastic.FindRelatedAlerts(alertInfo)
 		if err != nil {