Add Network Security Analyzer Agent

[duel0]

#70

[vmayoral]

Thanks @duel0, pretty exciting to have this into the architecture.

Some comments:

• agent follows the general pattern, but I don't see how it's "intercepting" traffic to then add it to the context and analyze it. Do you expect the LLM to do this proactively in a background session? Isn't this suboptimal as it'll loose most traffic between "captures"?
• can you provide a log/example that can be easily reproduced and that shows the Agent's behavior in your testing environment conditions?

[duel0]

Added python functions to capture remote traffic in the background.

[duel0]

SSH Client paramiko==3.5.1 needed for cai/tools/network/capture_traffic.py

[duel0]

Edited functions to avoid a continuous read from tshark, limited to 100 packets per-single-read

[vmayoral]

Liked a lot this iteration @duel0, nicely done. Ready from my side to be merged. Please confirm if you're fine moving forward or if you expect any further modifications in this iteration.

The following couple of (containerized) exercises demonstrate the capabilities of what's implemented herein:

test 1	test 2

An additional thoughts: currently the proposed agent has no Handoff to other agents. I understand this as a result of testing but in an operational scenario, wouldn't it be interesting to consider doing so? I particularly believe that the DFIR agent could be a decent target (for a handoff). Specially if expanded with shodan_search and make_google_search searching capabilities, so that recorded traffic can be somehow correlated with online searching.

Overall, nicely done.

[duel0]

• Integrated DFIR Agent handoff functionality into Network Security Analyzer.
• Added Google Search and Shodan Search capabilities to the DFIR Agent (conditional on API key availability).
• Added think functionality to the DFIR Agent to enhance investigation performance.

Note: the dependency paramiko==3.5.1 is required but not included in this PR, it needs to be added separately.

[duel0]

Added paramiko dependency