Inférence et planification

HYPOTHESIS credential_attack {
    PRIOR 0.05

    EVIDENCE {
        GROUP endpoint_signal {
            wazuh.alert_count > 20
                LIKELIHOOD 0.92 GIVEN_NOT 0.06
            network.anomaly_score > 0.75
                LIKELIHOOD 0.85 GIVEN_NOT 0.20
        }
        endpoint.integrity == compromised
            LIKELIHOOD 0.75 GIVEN_NOT 0.08
    }

    MAX_EVIDENCE 8
    THRESHOLD 0.90
    EXPLAINS threat.kind
}

agentl infer incident.agent --ticks 0

TOOL restart_service {
    REQUIRES { diagnosis.done == yes }
    EFFECT   { service.http_status = 200 }
    COST     5
}

PLANNER {
    ENABLE
    ACHIEVE service.http_status == 200
    MAX_DEPTH 3
    MAX_NODES 500
    APPROVAL_COST 10
}

agentl plan incident.agent --ticks 1

DECIDE {
    RULES {
        IF planner.exhausted AND goal.satisfied != yes
            THEN escalate_to_operator
    }
}