Wazuh/Meta Attack Language (MAL) Interface for Cyber Defense Agents

This code library contains functions to faciliate agents based on the Meta Attack Language to interface with a computer network via the SIEM platform Wazuh.
This library is also known as the "Tyr Monitor", "CRATE Monitor" and "ADS monitor" across various documentation and code.

What is this

This library contains two things:

• Code to map agent observations and actions between Wazuh and MAL.
• Code to run repeated experiments, where the agent monitors the network for a set period of time.

While running, the monitor will poll Wazuh at a given rate, and ask the agent for actions. 
Events generated by Wazuh are converted to the MAL data model, and stored in a database. 
The database is then used as the basis for agent actions.

The code is provided as it was used during our experiments and data collection, along with the config-files and model weights we have used.
This is means that while it is usable and accurate to how it was used, it could also benefit from additional refinement and documentation.

Installation

This project uses uv for dependency management. Run uv sync --extra cu128 for PyTorch compiled with CUDA 12.8 and uv sync --extra cpu for CPU only. The code has been tested and run on Ubuntu LTS 24.04 and Debian Bookworm.

How to use

You can either run a single episode, either offline using saved data or live with an actual SIEM, or use one of the scripts to schedule multiple runs. You can see a number of example configurations in the configs/ folder.

The following command runs the monitor offline for a single episode with the Wazuh file specified in wazuh_file_config.yml

uv run scripts/run_round.py \
--config configs/wazuh_file_config.yml \
--iteration-mode SKIP_WAIT \
--responder-mode SKIP_SEND \
--time-mode FAKE

To start the experiment runner to run in two hour periods, as was done for our data collection, you can run:
uv run scripts/run_on_repeat.py \
--config-file configs/tired_hope.yml \
--start-time "00:30" \
--run_length_minutes 120 \
--period_minutes 180 \
--polling_time_seconds 30 \
--number-runs 8 \
--agent_selection.method "shuffle" \
--slack_webhook "$webhook"