warren

AI agent and Slack based security alert management tool

Concept

How it works

Usage

Options

The following options can be configured via command line flags or environment variables:

`serve` mode

--addr (WARREN_ADDR): Address to listen on [default: "127.0.0.1:8080"]

`run` mode

--alert, -a (WARREN_ALERT_PATH): Alert file path [required]
--schema, -s (WARREN_ALERT_SCHEMA): Alert schema definition [required]

Common

Gemini (Required)

--gemini-location: GCP Location for Vertex AI (default: "us-central1") [$WARREN_GEMINI_LOCATION]
--gemini-model: Gemini model (default: "gemini-2.0-flash-exp")
--gemini-project-id: GCP Project ID for Vertex AI [$WARREN_GEMINI_PROJECT_ID]

Policy (Required)

--policy, -p: Policy file/dir path [$WARREN_POLICY]

Firestore (Required for `serve` mode)

--firestore-database-id: Firestore database ID (default: "(default)") [$WARREN_FIRESTORE_DATABASE_ID]
--firestore-project-id: Firestore project ID [$WARREN_FIRESTORE_PROJECT_ID]

Slack (Required for `serve` mode)

--slack-channel-name: Slack channel name, # is not required [$WARREN_SLACK_CHANNEL_NAME]
--slack-oauth-token: Slack OAuth token [$WARREN_SLACK_OAUTH_TOKEN]
--slack-signing-secret: Slack signing secret [$WARREN_SLACK_SIGNING_SECRET]

Sentry (Optional for `serve` mode)

--sentry-dsn: Sentry DSN [$WARREN_SENTRY_DSN]
--sentry-env: Sentry environment [$WARREN_SENTRY_ENV]

Action

--bigquery-config: BigQuery config file [$WARREN_BIGQUERY_CONFIG]
--bigquery-project-id: BigQuery project ID [$WARREN_BIGQUERY_PROJECT_ID]
--otx-api-key: OTX API key [$WARREN_OTX_API_KEY]
--otx-base-url: OTX API base URL (default: "https://otx.alienvault.com/api/v1") [$WARREN_OTX_BASE_URL]
--urlscan-api-key: URLScan API key [$WARREN_URLSCAN_API_KEY]
--urlscan-backoff: URLScan API backoff duration (default: 3s) [$WARREN_URLSCAN_BACKOFF]
--urlscan-base-url: URLScan API base URL (default: "https://urlscan.io/api/v1") [$WARREN_URLSCAN_BASE_URL]

License

Apache 2.0 License