feat: Prowler Analyst #7508

Chan9390 · 2025-04-14T15:14:03Z

Context

Feature adding Prowler Analyst.

Description

Please include a summary of the change and which issue is fixed. List any dependencies that are required for this change.

Checklist

Are there new checks included in this PR? No
- If so, do we need to update permissions for the provider? Please review this carefully.
Review if the code is being covered by tests.
Review if code is being documented following this specification https://github.com/google/styleguide/blob/gh-pages/pyguide.md#38-comments-and-docstrings
Review if backport is needed.
Review if is needed to change the Readme.md
Ensure new entries are added to CHANGELOG.md, if applicable.

API

Verify if API specs need to be regenerated.
Check if version updates are required (e.g., specs, Poetry, etc.).
Ensure new entries are added to CHANGELOG.md, if applicable.

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

gmaster1405

Apply

paabloLC

Submitting the comments I have so far. I’ll continue in a bit

ui/types/ai/index.ts

paabloLC · 2025-04-21T07:25:50Z

ui/types/ai/users.ts

+// Get Users Schema
+
+const userFieldsEnum = z.enum([
+  "",


do we need this empty string in all the types? Just curious, could you tell me why? Thanks

Yes, while experimenting with OpenAI models gpt-4o and gpt-4o-mini, if we add a type without "" as an additional element in it, the LLM model picked a random element from the type even if it wasn't required to pick (ex: filters, sort, etc). Hence added an empty string to every type where the LLM selects the option.

ui/types/chatbot/chatbot.ts

ui/types/chatbot/index.ts

ui/package.json

ui/app/(ai)/analyst/(tools)/roles.ts

ui/app/(ai)/analyst/(tools)/scans.ts

ui/app/(ai)/analyst/(tools)/users.ts

api/src/backend/api/models.py

api/src/backend/api/rls.py

AdriiiPRodri · 2025-04-21T09:30:28Z

api/src/backend/api/v1/serializers.py

+    def to_representation(self, instance):
+        ret = super().to_representation(instance)
+        # Add back the masked API key for display
+        ret["api_key"] = "*" * len(instance.api_key) if instance.api_key else None
+        return ret


I think that we can omit the key length, the api keys can change so I think it is better to fix a value like for example 8

Just FYI, we usually avoid credentials on read serializers. If the value is going to be ***, it does not provide any useful information anyway.

The main goal of this is to display the API key as ****** in Lighthouse config page.

@vicferpoy Because all AI interactions happen from UI, the UI needs to access OpenAI/other LLM keys (so I guess this credential should be on read serializer).

For now, implemented this:

/api/v1/lighthouse-config - All configured keys (current logic only checks for OpenAI keys but later can support other LLMs)

/api/v1/lighthouse-config/<UUID> - Gives the selected model and business context along with ******** just to show in UI that the AI key is configured

/api/v1/lighthouse-config/<UUID>/show_key - Gives the actual key

Please let me know if there's a better way.

I would use a query parameter then to either show the key or not. Another endpoint is not necessary.

api/src/backend/api/v1/views.py

AdriiiPRodri · 2025-04-21T09:37:11Z

api/src/backend/api/v1/views.py

+        if LighthouseConfig.objects.filter(tenant_id=request.tenant_id).exists():
+            return Response(
+                {"detail": "AI configuration already exists. Use PUT to update."},
+                status=status.HTTP_400_BAD_REQUEST,
+            )


We can use the serializers validate method like in provider-groups and this way specify which attribute produce the error

https://www.django-rest-framework.org/api-guide/validators/#uniquetogethervalidator

Check ProcessorCreateSerializer for reference.

api/src/backend/api/v1/views.py

Co-authored-by: Adrián Jesús Peña Rodríguez <adrianjpr@gmail.com>

api/src/backend/api/tests/test_views.py

vicferpoy · 2025-04-24T15:04:01Z

api/src/backend/api/tests/test_views.py

+        response = authenticated_client.post(
+            "/api/v1/lighthouse-config/",
+            data=valid_config_payload,
+            content_type=API_JSON_CONTENT_TYPE,
+        )
+        assert response.status_code == status.HTTP_201_CREATED
+        config_id = response.json()["data"]["id"]
+
+        # Retrieve config
+        response = authenticated_client.get(f"/api/v1/lighthouse-config/{config_id}/")
+        assert response.status_code == status.HTTP_200_OK
+        data = response.json()["data"]
+        assert data["attributes"]["name"] == "Test Config"
+        assert data["attributes"]["api_key"] == "*" * len(
+            valid_config_payload["data"]["attributes"]["api_key"]
+        )


This is not a unit test if you depend on a POST for a retrieval. Use pytest fixtures instead so you already have items to work with in the database when the test begins.

Apply this principle on every other test, please.

I've updated the tests, please check. Thanks!

vicferpoy · 2025-04-24T15:10:18Z

api/src/backend/api/v1/views.py

+            return Response(
+                {"api_key": decrypted_key},
+                status=status.HTTP_200_OK,
+            )


This does not follow the JSON:API specification.

vicferpoy · 2025-04-24T15:12:26Z

api/src/backend/api/v1/views.py

@@ -2565,3 +2572,126 @@ def get_serializer_context(self):
        context = super().get_serializer_context()
        context["allowed_providers"] = self.allowed_providers
        return context
+
+
+class LighthouseConfigViewSet(BaseRLSViewSet):


The CRUD endpoints could be omitted to avoid undesired behavior if they do not need to perform any extra action. If they just manage the resource in the database, it's not necessary to define the functions and the view is left clearer.

I've removed update and destroy as they are not really doing anything. For create we need the custom LighthouseConfigSerializer serializer to have a masked key in output. Update also used the serializer but the response doesn't contain the API key field and that's okay.

vicferpoy · 2025-04-24T15:13:30Z

api/src/backend/api/v1/views.py

+        try:
+            client = openai.OpenAI(
+                api_key=instance.api_key_decoded,
+            )
+            models = client.models.list()
+            return Response(
+                {
+                    "detail": "Connection successful!",
+                    "available_models": [model.id for model in models.data],
+                },
+                status=status.HTTP_200_OK,
+            )


Can this connection check last more than 1 second? If so, we should delegate this to a task like the provider connection check. It would also follow the JSON:API specification.

Currently this API method is not integrated in UI. @paabloLC is connection check needed for OpenAI or LLM keys thats configured in Prowler?

api/src/backend/api/v1/views.py

vicferpoy · 2025-04-24T15:17:15Z

api/src/backend/api/v1/serializers.py

+    def to_representation(self, instance):
+        ret = super().to_representation(instance)
+        # Add back the masked API key for display
+        ret["api_key"] = "*" * len(instance.api_key) if instance.api_key else None
+        return ret


I would use a query parameter then to either show the key or not. Another endpoint is not necessary.

vicferpoy · 2025-04-24T15:19:44Z

api/src/backend/api/v1/serializers.py

+    def validate(self, attrs):
+        tenant_id = self.context.get("request").tenant_id
+        if LighthouseConfig.objects.filter(tenant_id=tenant_id).exists():
+            raise serializers.ValidationError(
+                {
+                    "tenant_id": "AI configuration already exists for this tenant. Use PUT to update."
+                }
+            )
+        return super().validate(attrs)


You are still missing what I suggested in #7508 (comment).

Not changing this as discussed on Slack thread - https://prowler-workspace.slack.com/archives/C08BGLVDJ4D/p1745935957195789

paabloLC

I added more comments for now, thank you @Chan9390

paabloLC · 2025-04-25T07:57:44Z

ui/actions/lighthouse/compliances.ts

@@ -0,0 +1,87 @@
+import { apiBaseUrl, getAuthHeaders, parseStringify } from "@/lib/helper";
+
+export const aiGetCompliancesOverview = async ({


The path /prowler/ui/actions/lighthouse/compliances.ts looks good enough because there is only 1 file related to compliance.

Aside from that, I would suggest starting the function name with get, something like getLighthouseComplianceOverview , to keep it consistent with our naming conventions. What do you think about that?

By doing that, we're also removing the ai from the name.

ui/actions/lighthouse/compliances.ts

ui/actions/lighthouse/lighthouse.ts

ui/app/(ai)/analyst/prompts.ts

ui/app/(ai)/analyst/route.ts

ui/app/(ai)/analyst/utils.ts

ui/app/(ai)/cache/api/create/route.ts

ui/app/(ai)/cache/lib/cache.ts

paabloLC

Adding a few more comments. Thank you, @Chan9390

paabloLC · 2025-04-29T10:21:48Z

ui/actions/lighthouse/compliances.ts

+  fields?: string[];
+  filters?: Record<string, string | number | boolean | undefined>;
+  page?: number;
+  page_size?: number;


This page_size should be pageSize for consistency. Thank you

paabloLC · 2025-04-29T10:26:05Z

ui/app/(prowler)/lighthouse/chat.tsx

+  ];
+
+  return (
+    <div className="flex h-[calc(100vh-theme(spacing.16))] min-w-0 flex-col bg-background">


Can you use the <ContentLayout> component? I don't think you need a new layout for this. Take a look at any other page.

<ContentLayout title="Configure Chatbot" icon="lucide:settings">

If so, please, remove the app/(prowler)/lighthouse/config/layout.tsx

paabloLC · 2025-04-29T10:27:17Z

ui/app/(prowler)/lighthouse/config/layout.tsx

+  children: React.ReactNode;
+}
+
+export default function ChatbotConfigLayout({


Please check my previous comment; we probably don't need this.

paabloLC · 2025-04-29T10:29:02Z

ui/app/(prowler)/lighthouse/config/page.tsx

@@ -0,0 +1,274 @@
+"use client";


Please don't add use client to any page in the app. We're using SSR capabilities from Next.js 14. There are no pages with use client in the entire project, so let's avoid introducing it.

For references: https://nextjs.org/docs/14/app/building-your-application/rendering

Hi, I dont know how to fix this. If I remove use client, the configured API keys and business context are not shown. Please let me know how to fix this.

paabloLC · 2025-04-29T10:29:30Z

ui/app/(prowler)/lighthouse/chat.tsx

@@ -0,0 +1,136 @@
+"use client";


Please don't add use client to any page in the app. We're using SSR capabilities from Next.js 14. There are no pages with use client in the entire project, so let's avoid introducing it.

For references: https://nextjs.org/docs/14/app/building-your-application/rendering

I tried to not use client, but somehow because of AI SDK, use client is the only solution I found.

If I removed "use client" in chat.tsx, the page errors out with the following:

⨯ ./node_modules/@ai-sdk/react/dist/index.mjs Attempted import error: 'swr' does not contain a default export (imported as 'useSWR'). Import trace for requested module: ./node_modules/@ai-sdk/react/dist/index.mjs ./app/(prowler)/lighthouse/page.tsx

I don't know how to solve this. Please let me know if there's a way. Thanks!

paabloLC · 2025-04-29T10:51:33Z

ui/lib/lighthouse/tools/findings.ts

+
+export const getFindingsTool = tool(
+  async ({ page, pageSize, query, sort, filters }) => {
+    return await getFindings({ page, pageSize, query, sort, filters });


here you have pageSize correctly

ui/package.json

paabloLC · 2025-04-29T10:53:20Z

ui/types/lighthouse/findings.ts

+
+// Get Findings Schema
+
+// const findingFieldsEnum = z.enum([


do we need this commented code?

paabloLC · 2025-04-29T10:53:40Z

ui/types/lighthouse/overviews.ts

+
+// Get Findings By Status
+
+// const findingsOverviewFieldsEnum = z.enum([


do we need this commented code?

paabloLC · 2025-04-29T10:53:52Z

ui/types/lighthouse/providers.ts

+
+// Get Providers Schema
+
+// const providerFieldsEnum = z.enum([


do we need this commened code?

Co-authored-by: Víctor Fernández Poyatos <vicferpoy@gmail.com>

This reverts commit 6df035e.

Chan9390 requested review from a team as code owners April 14, 2025 15:14

github-actions bot added component/ui component/api review-django-migrations labels Apr 14, 2025

gmaster1405 approved these changes Apr 17, 2025

View reviewed changes

gmaster1405 suggested changes Apr 17, 2025

View reviewed changes

prowler-cloud deleted a comment from gmaster1405 Apr 21, 2025

paabloLC requested changes Apr 21, 2025

View reviewed changes

Chan9390 requested review from a team as code owners April 21, 2025 08:41

github-actions bot added documentation provider/aws provider/gcp github_actions output/html compliance labels Apr 21, 2025

Chan9390 force-pushed the prowler-analyst branch from 4f0af78 to 8939a5a Compare April 21, 2025 08:45

AdriiiPRodri requested changes Apr 21, 2025

View reviewed changes

Chan9390 and others added 11 commits April 24, 2025 16:31

Resolve provider type conflict

812b3e6

Update checks and compliance framework IDs

5fab05e

Remove console.log statements

fccc4be

Remove unused interface

19c1d7a

Add barrel file to types

c2f6364

Rename ai types folder to lighthouse

d2fd8d9

Revert formatted code

ac59fd7

Update key decryption logic

f265fa6

Co-authored-by: Adrián Jesús Peña Rodríguez <adrianjpr@gmail.com>

Remove update in Lighthouse View

f378903

Co-authored-by: Adrián Jesús Peña Rodríguez <adrianjpr@gmail.com>

Update logic as per feedback

eaf8a0e

Fix serializers to store config

1045fdc

Chan9390 added 7 commits April 24, 2025 16:31

Fix decryption to show key

47cace3

Add tests for lighthouse config

5265991

Add langsmith tracing support

6ef82a6

Use specific model snapshots

f3aa706

Remove exception handling from prompts

9191d16

Update default configuration

6235d9a

Structure prompts

dc58aa2

Chan9390 force-pushed the prowler-analyst branch from 850e344 to dc58aa2 Compare April 24, 2025 11:04

Chan9390 added 2 commits April 24, 2025 16:34

Update supervisor prompt

b484586

Rename microsoft365 to m365

08fd726

vicferpoy requested changes Apr 24, 2025

View reviewed changes

paabloLC requested changes Apr 25, 2025

View reviewed changes

Chan9390 added 3 commits April 27, 2025 13:06

Restructure lighthouse files

8dc806e

Add API routes to lighthouse

ae39dcc

Fix NextJS errors

289245f

paabloLC requested changes Apr 29, 2025

View reviewed changes

Chan9390 and others added 14 commits April 29, 2025 19:36

Fix Django tests

222b4fb

Add tenant filtering to LighthouseConfig queries

da87467

Co-authored-by: Víctor Fernández Poyatos <vicferpoy@gmail.com>

chore: add link to hub

bca80a7

Update Lighthouse show key response

a0904cc

Use UniqueTogetherValidator instead of custom validate function

6df035e

Remove update and destroy CRUD methods

4e5f335

Revert "Use UniqueTogetherValidator instead of custom validate function"

f218cea

This reverts commit 6df035e.

Change name to Lighthouse

d66fbad

Fix NextJS reviews

2fc0a50

Update prompt

e18b6c4

Make textbox input better

acdc4ce

Add auto scrolling

bbf668d

Remove show_key endpoint

5e618bc

Nudge users to add OpenAI key

7f1b059

		@@ -0,0 +1,87 @@
		import { apiBaseUrl, getAuthHeaders, parseStringify } from "@/lib/helper";

		export const aiGetCompliancesOverview = async ({


		// Get Findings By Status

		// const findingsOverviewFieldsEnum = z.enum([


		// Get Providers Schema

		// const providerFieldsEnum = z.enum([

feat: Prowler Analyst #7508

Are you sure you want to change the base?

feat: Prowler Analyst #7508

Conversation

Chan9390 commented Apr 14, 2025

Context

Description

Checklist

API

License

gmaster1405 left a comment

Choose a reason for hiding this comment

paabloLC left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

paabloLC left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

paabloLC left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment