Repository navigation
security: Complete audit logging and threat intelligence integrations #67
Description
Summary
Two security-critical TODO items remain unimplemented:
- Security audit logging integration
- External threat intelligence API integrations (VirusTotal, URLVoid)
Current State
TODO #1 - src/security/secure_llm_command_parser.py:300:
# TODO: Integrate with enhanced_security_layer.audit_log()TODO #2 - src/security/domain_security.py:522:
# TODO: Implement VirusTotal, URLVoid integration when API keys are availableRequirements
1. Audit Logging Integration
Goal: Connect secure_llm_command_parser to centralized audit logging
Implementation:
- Import
enhanced_security_layermodule - Call
audit_log()for:- Command parsing attempts
- Blocked commands (security violations)
- Allowed commands (for audit trail)
- Include metadata: timestamp, user context, command details, result
Example:
from src.security.enhanced_security_layer import audit_log
# After parsing command
audit_log(
event_type="llm_command_parsed",
command=parsed_command,
result="allowed|blocked",
reason="security_policy_violation" if blocked else None
)2. Threat Intelligence API Integration
Goal: Integrate external threat intelligence for URL/domain validation
VirusTotal API:
- Check URLs against VirusTotal database
- Get malware/phishing scores
- Rate limiting (4 requests/min for free tier)
- API key management via environment variable
URLVoid API:
- Secondary domain reputation check
- Blacklist status verification
- Additional threat indicators
Implementation Pattern:
async def check_url_reputation(url: str) -> ThreatScore:
"""Check URL against threat intelligence services"""
vt_score = await virustotal_check(url)
uv_score = await urlvoid_check(url)
return ThreatScore(
virustotal=vt_score,
urlvoid=uv_score,
risk_level=calculate_risk(vt_score, uv_score)
)Acceptance Criteria
Audit Logging
-
secure_llm_command_parser.pyintegrated withaudit_log() - All security-relevant events logged
- Audit trail includes: timestamp, event type, details, outcome
- Logs stored securely (no sensitive data exposure)
- Unit tests for audit logging integration
Threat Intelligence
- VirusTotal API client implemented
- URLVoid API client implemented
- API keys managed via environment variables (
VIRUSTOTAL_API_KEY,URLVOID_API_KEY) - Graceful degradation when APIs unavailable
- Rate limiting implemented
- Caching for repeated checks (avoid API quota waste)
- Integration with
domain_security.py - Unit tests with mocked API responses
Environment Variables
# Add to .env
VIRUSTOTAL_API_KEY=your_key_here
URLVOID_API_KEY=your_key_here
# Optional rate limiting
VIRUSTOTAL_RATE_LIMIT=4 # requests per minute
URLVOID_RATE_LIMIT=10Testing
- Unit tests for audit log integration
- Unit tests for VirusTotal client (mocked)
- Unit tests for URLVoid client (mocked)
- Integration test for threat score calculation
- Test graceful degradation without API keys
Security Considerations
- API keys stored securely (never in code)
- Rate limiting to avoid API abuse
- Caching to reduce external requests
- Fallback behavior when services unavailable
- No sensitive data leaked in logs
Related Files
src/security/secure_llm_command_parser.pysrc/security/domain_security.pysrc/security/enhanced_security_layer.pysrc/utils/http_client.py(for API requests)
Estimated Effort
4-6 hours:
- Audit logging: 1-2 hours
- VirusTotal integration: 2-3 hours
- URLVoid integration: 1-2 hours
- Testing: 2+ hours
Priority
High - Security infrastructure improvements for production readiness
Activity
mrveiss commentedon Dec 23, 2025
Starting work on this issue. Will implement:
secure_llm_command_parser.pyto centralized audit loggingBreaking down into subtasks and beginning implementation.
mrveiss commentedon Dec 23, 2025
Completed ✅
Changes Made:
1. Audit Logging Integration
secure_llm_command_parser.pyalready has complete audit logging integration (lines 306-316)_log_security_event()method properly callsEnhancedSecurityLayer.audit_log()with:llm_command_parser:command_blocked)2. Threat Intelligence API Integration
src/security/threat_intelligence.pymodule (674 lines) with:VirusTotalClient- VirusTotal API v3 integration for URL reputation checkingURLVoidClient- URLVoid API integration for domain reputation checkingThreatIntelligenceService- Aggregates results from multiple sourcesRateLimiter- Async rate limiting (4 req/min for VT free tier, 10 req/min for URLVoid)ThreatIntelligenceCache- 2-hour TTL caching to reduce API callsThreatScoredataclass with aggregated threat assessment3. Domain Security Integration
domain_security.pyto use threat intelligence service_check_reputation_services()now checks VirusTotal/URLVoid when API keys configuredget_threat_intel_status()async method for service monitoring4. Security Hardening
defusedxml>=0.7.1to requirements.txtAcceptance Criteria Verified:
Audit Logging:
secure_llm_command_parser.pyintegrated withaudit_log()✅ (already complete)Threat Intelligence:
VIRUSTOTAL_API_KEY,URLVOID_API_KEY) ✅domain_security.py✅Testing:
Commits:
feat(security): Complete threat intelligence API integrations (#67)
mrveiss commentedon Dec 23, 2025
Frontend Integration Complete ✅
Added threat intelligence frontend module with full integration:
Backend API Endpoints
GET /api/security/threat-intel/status- Service configuration statusPOST /api/security/threat-intel/check-url- URL reputation checkingGET /api/security/domain-security/stats- Domain security statisticsFrontend Components
ThreatIntelligenceDashboard.vue- Main dashboard with:ThreatIntelligenceSettings.vue- Settings panel for:Navigation
/analytics/securityand/analytics/security/settingsCommits
8f647775: Backend threat intelligence module75646281: Frontend threat intelligence moduleAll code committed, tests passing, and synced to frontend VM.
feat(security): Add threat intelligence frontend module (#67)
feat(security): Complete threat intelligence API integrations (#67)
feat(security): Add threat intelligence frontend module (#67)