Skip to content

Commit 5b45e3a

Browse files
jace-ryanclaude
andcommitted
docs: clean up playbooks and wiring guide
- full-irp-template.md: proper CC-BY-SA-4.0 attribution for Petronella source material, remove sales CTAs and phone numbers - Individual playbooks: strip leaked parent-doc section numbers (e.g. "### 5." → "###") - WIRING.md: remove non-existent Gradio and Open WebUI sections (were documented but never implemented) Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
1 parent 7486c92 commit 5b45e3a

5 files changed

Lines changed: 177 additions & 258 deletions

File tree

docs/WIRING.md

Lines changed: 38 additions & 91 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,11 @@ Step-by-step instructions for connecting every external dependency.
66

77
## Chat UI Options
88

9-
Gone-Phishing ships with a built-in single-file web UI (`web/index.html`). You can swap it for a more capable chat engine by setting `CHAT_UI` in `.env`.
9+
Gone-Phishing ships with a built-in single-file web UI (`web/index.html`). You can swap it for a more capable chat engine by setting `CHAT_UI` in `.env`.
1010

1111
### Option 1: Built-in (default)
1212

13-
Zero dependencies. A single-page dark-theme chat interface served directly by FastAPI.
13+
Zero dependencies. A single-page dark-theme chat interface served directly by FastAPI.
1414

1515
```bash
1616
CHAT_UI=builtin # or just don't set it
@@ -24,9 +24,9 @@ Good for demos, air-gapped environments, and keeping the dependency tree minimal
2424

2525
### Option 2: Chainlit
2626

27-
[Chainlit](https://github.com/Chainlit/chainlit) (Apache 2.0, 9k+ stars) mounts directly into your FastAPI process — no separate server, no Docker, no JavaScript build step. It gives you streaming responses, step visualisation, file upload, auth (OAuth / header), and a polished React frontend out of the box.
27+
[Chainlit](https://github.com/Chainlit/chainlit) (Apache 2.0, 9k+ stars) mounts directly into your FastAPI process — no separate server, no Docker, no JavaScript build step. It gives you streaming responses, step visualisation, file upload, auth (OAuth / header), and a polished React frontend out of the box.
2828

29-
**Why it's a good fit:** The IRP engine already runs FastAPI. Chainlit plugs in with one function call (`mount_chainlit`), inherits your existing endpoints, and adds a production-grade chat UI at `/chat`.
29+
**Why it's a good fit:** The IRP engine already runs FastAPI. Chainlit plugs in with one function call (`mount_chainlit`), inherits your existing endpoints, and adds a production-grade chat UI at `/chat`.
3030

3131
```bash
3232
pip install chainlit>=2.10.0
@@ -43,60 +43,7 @@ cd server && python app.py
4343
# Chat → http://localhost:8100/chat
4444
```
4545

46-
The Chainlit integration lives in `server/cl_app.py`. Customise it to add step indicators for each IRP phase (Identification → Containment → Eradication → Recovery).
47-
48-
---
49-
50-
### Option 3: Open WebUI
51-
52-
[Open WebUI](https://github.com/open-webui/open-webui) (129k+ stars) is a full self-hosted AI platform. It runs as a separate Docker container and connects to any OpenAI-compatible API — which means you point it at Gone-Phishing's `/api/chat` endpoint.
53-
54-
**Why it's a good fit:** If you're already running Ollama or want a multi-model workspace with RAG, voice, and admin controls, Open WebUI is the nuclear option.
55-
56-
```bash
57-
# 1. Run Open WebUI
58-
docker run -d -p 3000:8080 \
59-
-v open-webui:/app/backend/data \
60-
--name open-webui \
61-
--restart always \
62-
ghcr.io/open-webui/open-webui:main
63-
64-
# 2. In Open WebUI settings → Connections, add a custom endpoint:
65-
# Base URL: http://host.docker.internal:8100
66-
# (or your server's LAN IP)
67-
```
68-
69-
Gone-Phishing's API is already OpenAI-shape enough for basic chat. For full compatibility, a thin adapter that maps `/v1/chat/completions` to `/api/chat` is included at `server/openai_compat.py` (TODO — straightforward to add if you go this route).
70-
71-
---
72-
73-
### Option 4: Gradio
74-
75-
[Gradio](https://github.com/gradio-app/gradio) (Hugging Face, Apache 2.0) is the fastest path from zero to interactive demo. Three lines of Python gives you a chat interface with streaming.
76-
77-
```python
78-
# server/gradio_app.py (create this file)
79-
import gradio as gr
80-
import httpx
81-
82-
def chat(message, history):
83-
messages = [{"role": r, "content": c} for r, c in history] + [{"role": "user", "content": message}]
84-
if len(messages) == 1:
85-
resp = httpx.post("http://localhost:8100/api/incident", json={"description": message})
86-
return resp.json().get("action_plan", "Error")
87-
resp = httpx.post("http://localhost:8100/api/chat", json={"messages": messages})
88-
return resp.json().get("response", "Error")
89-
90-
gr.ChatInterface(chat, title="Gone-Phishing IRP").launch(server_port=7860)
91-
```
92-
93-
```bash
94-
pip install gradio
95-
python server/gradio_app.py
96-
# → http://localhost:7860
97-
```
98-
99-
Good for rapid prototyping and internal demos. Not recommended for production.
46+
The Chainlit integration lives in `server/cl_app.py`. Customise it to add step indicators for each IRP phase (Identification → Containment → Eradication → Recovery).
10047

10148
---
10249

@@ -113,7 +60,7 @@ The CW integration (`server/tools/cw_tools.py`) is an MCP client that spawns you
11360
└──────────────┘ └────────────────┘
11461
```
11562

116-
Gone-Phishing spawns the Node process, establishes an MCP session, and calls tools like `cw_create_ticket` and `cw_add_ticket_note` through the protocol. The session is lazily initialised on first tool call and automatically reconnects if the subprocess dies.
63+
Gone-Phishing spawns the Node process, establishes an MCP session, and calls tools like `cw_create_ticket` and `cw_add_ticket_note` through the protocol. The session is lazily initialised on first tool call and automatically reconnects if the subprocess dies.
11764

11865
### Setup
11966

@@ -138,24 +85,24 @@ CW_BASE_URL=https://api-na.myconnectwise.net
13885

13986
`cw_tools.py` wraps these tools from the 73-tool MCP server:
14087

141-
| Python function | MCP tool | Purpose |
142-
|----------------------------|------------------------|-----------------------------------|
143-
| `tool_create_ticket()` | `cw_create_ticket` | Create incident ticket |
144-
| `tool_get_ticket()` | `cw_get_ticket` | Look up ticket by ID |
145-
| `tool_update_ticket()` | `cw_update_ticket` | Update via JSON Patch |
146-
| `tool_add_ticket_note()` | `cw_add_ticket_note` | Add internal/external notes |
147-
| `tool_list_tickets()` | `cw_list_tickets` | Search with CW conditions syntax |
148-
| `tool_list_ticket_notes()` | `cw_list_ticket_notes` | List notes on a ticket |
149-
| `tool_list_companies()` | `cw_list_companies` | Resolve company IDs |
150-
| `tool_list_boards()` | `cw_list_boards` | Resolve board IDs |
151-
| `tool_list_board_statuses()`| `cw_list_board_statuses`| Valid statuses for a board |
152-
| `tool_list_members()` | `cw_list_members` | Resolve owner identifiers |
88+
| Python function | MCP tool | Purpose |
89+
| ---------------------------- | ------------------------ | -------------------------------- |
90+
| `tool_create_ticket()` | `cw_create_ticket` | Create incident ticket |
91+
| `tool_get_ticket()` | `cw_get_ticket` | Look up ticket by ID |
92+
| `tool_update_ticket()` | `cw_update_ticket` | Update via JSON Patch |
93+
| `tool_add_ticket_note()` | `cw_add_ticket_note` | Add internal/external notes |
94+
| `tool_list_tickets()` | `cw_list_tickets` | Search with CW conditions syntax |
95+
| `tool_list_ticket_notes()` | `cw_list_ticket_notes` | List notes on a ticket |
96+
| `tool_list_companies()` | `cw_list_companies` | Resolve company IDs |
97+
| `tool_list_boards()` | `cw_list_boards` | Resolve board IDs |
98+
| `tool_list_board_statuses()` | `cw_list_board_statuses` | Valid statuses for a board |
99+
| `tool_list_members()` | `cw_list_members` | Resolve owner identifiers |
153100

154101
All 73 tools remain available if you need to extend beyond this subset — just add more wrapper functions following the same `_call_tool()` pattern.
155102

156103
### Graceful degradation
157104

158-
If `CW_MCP_SERVER_DIR` is not set or the server can't start, every tool function returns an error dict. The IRP engine stays fully operational — you just won't get CW ticket integration.
105+
If `CW_MCP_SERVER_DIR` is not set or the server can't start, every tool function returns an error dict. The IRP engine stays fully operational — you just won't get CW ticket integration.
159106

160107
### For Railway deployment
161108

@@ -179,26 +126,26 @@ The N8N integration (`server/tools/n8n_tools.py`) fires webhooks into your N8N i
179126
1. Import or build the matching workflows in your N8N instance.
180127
2. Each workflow should expose a webhook trigger node at these paths:
181128

182-
| Webhook path | Purpose |
183-
|----------------------|--------------------------------|
184-
| `/irp-escalation` | Severity-based alert fan-out |
185-
| `/irp-evidence` | RMM evidence collection |
186-
| `/irp-notify` | General notification routing |
129+
| Webhook path | Purpose |
130+
| ----------------- | ---------------------------- |
131+
| `/irp-escalation` | Severity-based alert fan-out |
132+
| `/irp-evidence` | RMM evidence collection |
133+
| `/irp-notify` | General notification routing |
187134

188-
3. Set `N8N_BASE_URL` in `.env`. Optionally set `N8N_WEBHOOK_SECRET` if your workflows validate it.
135+
3. Set `N8N_BASE_URL` in `.env`. Optionally set `N8N_WEBHOOK_SECRET` if your workflows validate it.
189136

190137
---
191138

192139
## LLM Providers
193140

194141
Set `LLM_PROVIDER` and `LLM_MODEL` in `.env`.
195142

196-
| Provider | Required env var | Example model |
197-
|-------------|------------------------|-----------------------------------|
198-
| `anthropic` | `ANTHROPIC_API_KEY` | `claude-sonnet-4-20250514` |
199-
| `openai` | `OPENAI_API_KEY` | `gpt-4o` |
200-
| `gemini` | `GOOGLE_API_KEY` | `gemini-1.5-pro` |
201-
| `ollama` | `OLLAMA_BASE_URL` | Set via `OLLAMA_MODEL` |
143+
| Provider | Required env var | Example model |
144+
| ----------- | ------------------- | -------------------------- |
145+
| `anthropic` | `ANTHROPIC_API_KEY` | `claude-sonnet-4-20250514` |
146+
| `openai` | `OPENAI_API_KEY` | `gpt-4o` |
147+
| `gemini` | `GOOGLE_API_KEY` | `gemini-1.5-pro` |
148+
| `ollama` | `OLLAMA_BASE_URL` | Set via `OLLAMA_MODEL` |
202149

203150
For Ollama, make sure `ollama serve` is running and you've pulled the model:
204151

@@ -235,14 +182,14 @@ Or connect via GitHub:
235182

236183
Set these in the Railway dashboard under your service's **Variables** tab:
237184

238-
| Variable | Required | Example |
239-
|---------------------|----------|--------------------------------|
240-
| `ANTHROPIC_API_KEY` | Yes* | `sk-ant-...` |
241-
| `LLM_PROVIDER` | No | `anthropic` (default) |
242-
| `LLM_MODEL` | No | `claude-sonnet-4-20250514` |
243-
| `CHAT_UI` | No | `builtin` (default) |
185+
| Variable | Required | Example |
186+
| ------------------- | -------- | -------------------------- |
187+
| `ANTHROPIC_API_KEY` | Yes\* | `sk-ant-...` |
188+
| `LLM_PROVIDER` | No | `anthropic` (default) |
189+
| `LLM_MODEL` | No | `claude-sonnet-4-20250514` |
190+
| `CHAT_UI` | No | `builtin` (default) |
244191

245-
*Required for default config. Set your chosen provider's key instead if using OpenAI/Gemini.
192+
\*Required for default config. Set your chosen provider's key instead if using OpenAI/Gemini.
246193

247194
Railway auto-injects `PORT` — the app binds to it automatically.
248195

playbooks/communication-plan.md

Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,23 @@
1-
### 6. Communication Plan
1+
### Communication Plan
22

33
#### Internal Communication
44

5-
| Audience | When to Notify | Method | Responsible |
6-
|----------|---------------|--------|-------------|
7-
| Executive team | S1 within 30 min; S2 within 4 hours | Phone, then email | IR Lead |
8-
| IT department | All severities, immediately | Teams/Slack, phone | IT Security |
9-
| Legal counsel | S1/S2 immediately; S3 within 24 hours | Phone | IR Lead |
10-
| HR | If employee involved | Phone | IR Lead |
11-
| Affected department heads | After initial assessment | Email or meeting | IR Lead |
12-
| All employees | If awareness needed | Email from management | Communications |
5+
| Audience | When to Notify | Method | Responsible |
6+
| ------------------------- | ------------------------------------- | --------------------- | -------------- |
7+
| Executive team | S1 within 30 min; S2 within 4 hours | Phone, then email | IR Lead |
8+
| IT department | All severities, immediately | Teams/Slack, phone | IT Security |
9+
| Legal counsel | S1/S2 immediately; S3 within 24 hours | Phone | IR Lead |
10+
| HR | If employee involved | Phone | IR Lead |
11+
| Affected department heads | After initial assessment | Email or meeting | IR Lead |
12+
| All employees | If awareness needed | Email from management | Communications |
1313

1414
#### External Communication
1515

16-
| Audience | When to Notify | Method | Responsible |
17-
|----------|---------------|--------|-------------|
18-
| Cyber insurance carrier | S1/S2 within 24 hours | Phone | Legal/IR Lead |
19-
| Law enforcement | If criminal activity suspected | Phone to FBI field office | Legal |
20-
| Affected customers/individuals | Per regulatory requirements | Written notice | Legal/Communications |
21-
| Regulatory bodies | Per applicable regulations | Official channels | Legal |
22-
| Media | Only if necessary, after legal review | Press release/statement | Communications |
23-
| Business partners | If partner data affected | Phone/email | IR Lead |
16+
| Audience | When to Notify | Method | Responsible |
17+
| ------------------------------ | ------------------------------------- | ------------------------- | -------------------- |
18+
| Cyber insurance carrier | S1/S2 within 24 hours | Phone | Legal/IR Lead |
19+
| Law enforcement | If criminal activity suspected | Phone to FBI field office | Legal |
20+
| Affected customers/individuals | Per regulatory requirements | Written notice | Legal/Communications |
21+
| Regulatory bodies | Per applicable regulations | Official channels | Legal |
22+
| Media | Only if necessary, after legal review | Press release/statement | Communications |
23+
| Business partners | If partner data affected | Phone/email | IR Lead |

0 commit comments

Comments
 (0)