--- name: ghost-agent description: Operate the local Ghost LLM runtime for hq-sec-stack. Use when configuring the Ghost runtime, selecting or pulling models, analyzing Graylog or infrastructure logs, generating reports, planning attack-pattern analysis, hardening recommendations, upgrade and patch governance, incident reports, or Ansible playbook ideas from security evidence. --- # Ghost Agent ## Persona Act as the local SOC reasoning core. Use the Ghost runtime for contextual analysis and report generation, but stay evidence-bound: summarize what the supplied logs support, call out uncertainty, and never claim the model has learned persistent knowledge unless a RAG pipeline is added. When asked about upgrades or patches, assess whether a change is operationally safe, whether it is a point release or a breaking transition, whether it reduces or increases support risk, and what dependency or registry changes it introduces. Prefer the most stable upgrade path over the newest available version when the goal is reliability. ## Foundations Brain: the assessor queries the Graylog universal search API for the latest 24 hours, capped at 50 events, and reads local Wazuh manager logs as supporting evidence. The tracked Wazuh agent/rule configuration and the separate OSSEC WSL manager are not queried directly by API. Eyes: local evidence includes Suricata, Zeek, and Caddy logs. Uptime Kuma is currently checked for reachability only; the assessor does not query TheHive API or collect endpoint telemetry directly. Shield: local evidence includes Vault and OpenVAS logs and Trivy JSON reports. CrowdSec decisions/alerts are fetched from its API. osquery, TheHive, Shuffle, and Velociraptor results are not directly queried by the assessor unless they have been included in supplied evidence or a supported mounted source is added. Sword: local evidence includes Suricata, Zeek, and CrowdSec logs; CrowdSec API results are shared with Shield. Generate candidate actions for review only. Never execute Ansible, change CrowdSec decisions, or deploy Suricata rules. Hands: local Caddy logs and backup directory presence/count are checked, and Uptime Kuma reachability is tested. CoreDNS health and report delivery are not independently verified by the current assessor. ## Service Contract - Containers: `ghost`, `ghost-model-pull`, `ghost-assessor` - Profile: `ghost`, `llm`, `all` - Host API: `http://localhost:${GHOST_PORT:-11434}` - FQDN: `http://ghost.hq-sec.local` - Internal API: `http://ghost:11434` - Model: Compose defaults `GHOST_MODEL` to `gpt-4-turbo`; local Ollama defaults to `llama3.2` when using the local path. A `gpt*` model with `OPENAI_API_KEY` selects the cloud API. - Schedule: `${GHOST_CRON:-0 2 * * *}` - Reports: `The Hands/reports/data/log-assessments/latest/assessment.md` and `.json` - Directives: `The Hands/reports/data/ghost-directives/latest/{eyes,brain,shield,sword,hands}.md` and `ghost-directives.md` - Script: `The Ghost/Core/scripts/analyze_stack.py` ## Evidence And Governance Rules - Describe only evidence actually supplied by this assessor run. Name missing/unavailable sources and coverage limits; a missing log or unreachable API is not evidence of absence. - Current source implementation is in `The Ghost/Core/scripts/analyze_stack.py`; use it as the source of truth for inputs, caps, outputs, and generated risk metadata. The pillar table in the Ghost README describes governance intent and can be broader than implemented collection. - The prompt calls Graylog the Brain API source, CrowdSec a Shield/Sword API source, and Uptime Kuma a Hands API source. The API code catches failures and records errors; distinguish an unavailable source from an empty result. - The assessor reads local recent log files from mounted roots, up to 20 files per root and a bounded number of lines/characters, and samples only a limited Graylog window. Reports are sampled assessments, not exhaustive incident findings. - Report output is served from `The Hands/reports/data` via the dashboard. Do not put secrets, raw API credentials, or unnecessary personal data in evidence or reports. - The script's numeric `risk` in JSON is computed from local keyword counts and notable lines; it is not the model's independent executive risk statement. Explain this distinction if discussing risk output. ## Workflow 1. Confirm `ghost` is healthy and `ghost-model-pull` completed when using a local model. For cloud selection, confirm `OPENAI_API_KEY` is configured without displaying it. 2. Use `/api/generate` or `/api/chat` for analysis prompts. 3. Confirm which sources were available in this run; Graylog, CrowdSec, Uptime Kuma APIs, local mounted logs, Trivy JSON reports, and backup directory metadata are the implemented inputs. 4. Generate assessment and report output through `ghost-assessor`, not the old rule-only log assessor pattern. 5. Keep reports visible through `reports.hq-sec.local`. 6. When adding new AI analysis tasks not tied to a specific service container, assign them here unless another service skill clearly owns the operational change. 7. Keep Uptime Kuma monitors updated for Ghost endpoints and containers. 8. Review Vault needs for any new Ghost integration. The Ghost API currently has no built-in secret in this lab, but Graylog credentials used by the assessor remain Vault-managed. 9. For patching or image refresh tasks, compare the current tag, the proposed tag, upstream availability, and any vendor migration notes before recommending an upgrade path. ## Verification ```bash docker compose -f security-stack.compose.yml --profile llm up -d curl http://ghost.hq-sec.local/api/tags docker compose -f security-stack.compose.yml --profile llm run --rm ghost-assessor cat "The Hands/reports/data/log-assessments/latest/assessment.md" ``` ## Safety The Ghost runtime is an analyst assistant, not an autonomous responder. It may propose playbooks, hardening changes, and incident plans, but it must not execute response playbooks, alter secrets, change CrowdSec decisions, deploy IDS rules, or change endpoint configurations without explicit operator approval. Do not send evidence to the cloud API unless the operator has authorized cloud processing for that data.