Mikaayenson

LOL-GAI — example outputs & how the scan works

Pipeline

--catalog     embedded knowledge (what CAN be abused)
     │
--scan        resolve binaries on this host (what IS installed)
     │
--probe       run --help/--version (timeout) → classify tokens

Mikaayenson

#!/usr/bin/env bash
# install-genai-tools.sh — Cross-platform installer for GenAI coding tools (LOL-GAI).
#
# Installs GenAI assistants, coding agents, and local model servers so you
# can validate process telemetry, network artifacts, config paths, and file
# behavior against detection rules.
#
# Platforms: macOS (Intel + Apple Silicon), Linux (x86_64 + arm64),
#            Windows x64 + ARM64 (Git Bash / WSL / MSYS2)
#

Mikaayenson

Category	Field	Type	Description
General LLM Interaction Fields	gen_ai.prompt	text	The full text of the user's request to the gen_ai.
	gen_ai.usage.prompt_tokens	integer	Number of tokens in the user's request.

|

Mikaayenson

name: ES|QL Validation
on:
  push:
    branches:
      - main
  workflow_dispatch:
    inputs:
      target_branch:
        description: 'Target Detection Rules Branch (e.g. esql_testing)'
        required: true

Mikaayenson

openapi: 3.0.0
info:
  title: Elastic Security SIEM Signals API (https://www.elastic.co/guide/en/security/current/security-apis.html)
  version: 1.0.0
servers:
  - url: 'http://{kibana_host}:{port}'
paths:
  /api/detection_engine/index:
    summary: Signal index operations (used to store detection alerts)
    post:

Mikaayenson

import openai
import requests
import textwrap
import uuid

# pip3 install openai requests
# setup the API credentials
es_username = "<your username>"
es_password = "<your password>"
es_url = "https://localhost:9200"