Leveraging LLMs for Alert Enrichment with Wazuh and YARA#

1
#!/bin/bash
2
# Wazuh - YARA active response with ChatGPT enrichment
3
# Copyright (C) 2015-2024, Wazuh Inc.
4
#
5
# This program is free software; you can redistribute it
6
# and/or modify it under the terms of the GNU General Public
7
# License (version 2) as published by the FSF - Free Software
8
# Foundation.
9

10
#------------------------- Configuration -------------------------#
11

12
# ChatGPT API Configuration
13
API_KEY="<YOUR_API_KEY>"
14
OPENAI_MODEL="<YOUR_MODEL>" # e.g., gpt-4-turbo
15

16
# Set LOG_FILE path
17
LOG_FILE="logs/active-responses.log"
18

19
#------------------------- Gather parameters -------------------------#
20

21
# Extra arguments
22
read INPUT_JSON
23
YARA_PATH=$(echo $INPUT_JSON | jq -r .parameters.extra_args[1])
24
YARA_RULES=$(echo $INPUT_JSON | jq -r .parameters.extra_args[3])
25
FILENAME=$(echo $INPUT_JSON | jq -r .parameters.alert.syscheck.path)
26

27
# Wait for file to be completely written
28
size=0
29
actual_size=$(stat -c %s ${FILENAME})
30
while [ ${size} -ne ${actual_size} ]; do
31
    sleep 1
32
    size=${actual_size}
33
    actual_size=$(stat -c %s ${FILENAME})
34
done
35

36
#----------------------- Analyze parameters -----------------------#
37

38
if [[ ! $YARA_PATH ]] || [[ ! $YARA_RULES ]]
39
then
40
    echo "wazuh-YARA: ERROR - YARA active response error. YARA path and rules parameters are mandatory." >> ${LOG_FILE}
41
    exit 1
42
fi
43

44
#------------------------- Main workflow --------------------------#
45

46
# Execute YARA scan with metadata
47
YARA_output="$("${YARA_PATH}"/yara -w -r -m "$YARA_RULES" "$FILENAME")"
48

49
if [[ $YARA_output != "" ]]
50
then
51
    # Attempt to delete the malicious file
52
    if rm -rf "$FILENAME"; then
53
        echo "wazuh-YARA: INFO - Successfully deleted $FILENAME" >> ${LOG_FILE}
54
    else
55
        echo "wazuh-YARA: INFO - Unable to delete $FILENAME" >> ${LOG_FILE}
56
    fi
57

58
    # Flag to check if API key is invalid
59
    api_key_invalid=false
60

61
    # Process each detected rule
62
    while read -r line; do
63
        # Extract the description from YARA metadata
64
        description=$(echo "$line" | grep -oP '(?<=description=").*?(?=")')
65

66
        if [[ $description != "" ]]; then
67
            # Prepare ChatGPT API request
68
            payload=$(jq -n \
69
                --arg desc "$description" \
70
                --arg model "$OPENAI_MODEL" \
71
                '{
72
                    model: $model,
73
                    messages: [
74
                        {
75
                            role: "system",
76
                            content: "In one paragraph, tell me about the impact and how to mitigate \($desc)"
77
                        }
78
                    ],
79
                    temperature: 1,
80
                    max_tokens: 256,
81
                    top_p: 1,
82
                    frequency_penalty: 0,
83
                    presence_penalty: 0
84
                }')
85

86
            # Query ChatGPT for threat analysis
87
            chatgpt_response=$(curl -s -X POST "https://api.openai.com/v1/chat/completions" \
88
                -H "Content-Type: application/json" \
89
                -H "Authorization: Bearer $API_KEY" \
90
                -d "$payload")
91

92
            # Check for API errors
93
            if echo "$chatgpt_response" | grep -q "invalid_request_error"; then
94
                api_key_invalid=true
95
                echo "wazuh-YARA: ERROR - Invalid ChatGPT API key" >> ${LOG_FILE}
96
                echo "wazuh-YARA: INFO - Scan result: $line | chatgpt_response: none" >> ${LOG_FILE}
97
            else
98
                # Extract the AI response
99
                response_text=$(echo "$chatgpt_response" | jq -r '.choices[0].message.content')
100

101
                if [[ $response_text == "null" ]]; then
102
                    echo "wazuh-YARA: ERROR - ChatGPT API returned null response: $chatgpt_response" >> ${LOG_FILE}
103
                else
104
                    # Combine YARA detection with AI enrichment
105
                    combined_output="wazuh-YARA: INFO - Scan result: $line | chatgpt_response: $response_text"
106
                    echo "$combined_output" >> ${LOG_FILE}
107
                fi
108
            fi
109
        else
110
            # No description found, log without enrichment
111
            echo "wazuh-YARA: INFO - Scan result: $line" >> ${LOG_FILE}
112
        fi
113
    done <<< "$YARA_output"
114

115
    # Log API key status if invalid
116
    if $api_key_invalid; then
117
        echo "wazuh-YARA: INFO - API key is invalid. ChatGPT response omitted." >> ${LOG_FILE}
118
    fi
119
else
120
    echo "wazuh-YARA: INFO - No YARA rule matched." >> ${LOG_FILE}
121
fi
122

123
exit 0;

1
<syscheck>
2
  <directories realtime="yes">/home</directories>
3
</syscheck>

1
import os
2
import subprocess
3
import json
4
import re
5
import requests
6
import time
7

8
# Configuration
9
API_KEY = '<YOUR_API_KEY>'
10
OPENAI_MODEL = '<YOUR_MODEL>'  # e.g., gpt-4-turbo
11

12
# Determine log file path based on architecture
13
if os.environ['PROCESSOR_ARCHITECTURE'].endswith('86'):
14
    log_file_path = os.path.join(os.environ['ProgramFiles'], 'ossec-agent', 'active-response', 'active-responses.log')
15
else:
16
    log_file_path = os.path.join(os.environ['ProgramFiles(x86)'], 'ossec-agent', 'active-response', 'active-responses.log')
17

18
def log_message(message):
19
    """Log message to Wazuh active response log"""
20
    with open(log_file_path, 'a') as log_file:
21
        log_file.write(message + '\n')
22

23
def read_input():
24
    """Read JSON input from stdin"""
25
    return input()
26

27
def get_syscheck_file_path(json_file_path):
28
    """Extract file path from Wazuh alert JSON"""
29
    with open(json_file_path, 'r') as json_file:
30
        data = json.load(json_file)
31
        return data['parameters']['alert']['syscheck']['path']
32

33
def run_yara_scan(yara_exe_path, yara_rules_path, syscheck_file_path):
34
    """Execute YARA scan with metadata extraction"""
35
    try:
36
        result = subprocess.run([yara_exe_path, '-m', yara_rules_path, syscheck_file_path],
37
                              capture_output=True, text=True, timeout=30)
38
        return result.stdout.strip()
39
    except subprocess.TimeoutExpired:
40
        log_message("wazuh-YARA: ERROR - YARA scan timed out")
41
        return None
42
    except Exception as e:
43
        log_message(f"wazuh-YARA: ERROR - Error running YARA scan: {str(e)}")
44
        return None
45

46
def extract_description(yara_output):
47
    """Extract threat description from YARA metadata"""
48
    match = re.search(r'description="([^"]+)"', yara_output)
49
    if match:
50
        return match.group(1)
51
    else:
52
        return None
53

54
def query_chatgpt(description):
55
    """Query ChatGPT for threat analysis and mitigation advice"""
56
    headers = {
57
        'Authorization': f'Bearer {API_KEY}',
58
        'Content-Type': 'application/json'
59
    }
60

61
    data = {
62
        'model': OPENAI_MODEL,
63
        'messages': [
64
            {
65
                'role': 'system',
66
                'content': f'In one paragraph, tell me about the impact and how to mitigate {description}'
67
            }
68
        ],
69
        'temperature': 1,
70
        'max_tokens': 256,
71
        'top_p': 1,
72
        'frequency_penalty': 0,
73
        'presence_penalty': 0
74
    }
75

76
    try:
77
        response = requests.post('https://api.openai.com/v1/chat/completions',
78
                               headers=headers, json=data, timeout=30)
79

80
        if response.status_code == 200:
81
            return response.json()['choices'][0]['message']['content']
82
        elif response.status_code == 401:  # Unauthorized (invalid API key)
83
            log_message("wazuh-YARA: ERROR - Invalid ChatGPT API key")
84
            return None
85
        else:
86
            log_message(f"wazuh-YARA: ERROR - ChatGPT API error: {response.status_code} {response.text}")
87
            return None
88
    except requests.exceptions.Timeout:
89
        log_message("wazuh-YARA: ERROR - ChatGPT API request timed out")
90
        return None
91
    except Exception as e:
92
        log_message(f"wazuh-YARA: ERROR - Error querying ChatGPT: {str(e)}")
93
        return None
94

95
def delete_file(file_path):
96
    """Attempt to delete the malicious file"""
97
    try:
98
        os.remove(file_path)
99
        if not os.path.exists(file_path):
100
            log_message(f"wazuh-YARA: INFO - Successfully deleted {file_path}")
101
            return True
102
        else:
103
            log_message(f"wazuh-YARA: INFO - Unable to delete {file_path}")
104
            return False
105
    except Exception as e:
106
        log_message(f"wazuh-YARA: ERROR - Error deleting file: {str(e)}")
107
        return False
108

109
def main():
110
    """Main execution flow"""
111
    json_file_path = r"C:\Program Files (x86)\ossec-agent\active-response\stdin.txt"
112
    yara_exe_path = r"C:\Program Files (x86)\ossec-agent\active-response\bin\yara\yara64.exe"
113
    yara_rules_path = r"C:\Program Files (x86)\ossec-agent\active-response\bin\yara\rules\yara_rules.yar"
114

115
    try:
116
        # Read input and parse file path
117
        input_data = read_input()
118

119
        with open(json_file_path, 'w') as json_file:
120
            json_file.write(input_data)
121

122
        syscheck_file_path = get_syscheck_file_path(json_file_path)
123

124
        # Run YARA scan
125
        yara_output = run_yara_scan(yara_exe_path, yara_rules_path, syscheck_file_path)
126

127
        if yara_output:
128
            description = extract_description(yara_output)
129

130
            if description:
131
                # Query ChatGPT for analysis
132
                chatgpt_response = query_chatgpt(description)
133

134
                if chatgpt_response:
135
                    combined_output = f"wazuh-YARA: INFO - Scan result: {yara_output} | chatgpt_response: {chatgpt_response}"
136
                else:
137
                    combined_output = f"wazuh-YARA: INFO - Scan result: {yara_output} | chatgpt_response: None"
138

139
                log_message(combined_output)
140

141
                # Delete the malicious file
142
                delete_file(syscheck_file_path)
143
            else:
144
                log_message(f"wazuh-YARA: INFO - Scan result: {yara_output}")
145
                log_message("wazuh-YARA: WARNING - No description found in YARA rule metadata")
146
        else:
147
            log_message("wazuh-YARA: INFO - YARA scan returned no output or failed")
148

149
    except Exception as e:
150
        log_message(f"wazuh-YARA: ERROR - Main execution error: {str(e)}")
151

152
if __name__ == "__main__":
153
    main()

1
<syscheck>
2
  <directories realtime="yes">C:\Users\*\Downloads</directories>
3
</syscheck>

1
<!-- Enhanced YARA Decoder with ChatGPT fields -->
2

3
<decoder name="YARA_decoder">
4
  <prematch>wazuh-YARA:</prematch>
5
</decoder>
6

7
<decoder name="YARA_child">
8
  <parent>YARA_decoder</parent>
9
  <regex type="pcre2">wazuh-YARA: (\S+)</regex>
10
  <order>YARA.log_type</order>
11
</decoder>
12

13
<decoder name="YARA_child">
14
  <parent>YARA_decoder</parent>
15
  <regex type="pcre2">Scan result: (\S+)\s+</regex>
16
  <order>YARA.rule_name</order>
17
</decoder>
18

19
<decoder name="YARA_child">
20
  <parent>YARA_decoder</parent>
21
  <regex type="pcre2">\[description="([^"]+)",</regex>
22
  <order>YARA.rule_description</order>
23
</decoder>
24

25
<decoder name="YARA_child">
26
  <parent>YARA_decoder</parent>
27
  <regex type="pcre2">author="([^"]+)",</regex>
28
  <order>YARA.rule_author</order>
29
</decoder>
30

31
<decoder name="YARA_child">
32
  <parent>YARA_decoder</parent>
33
  <regex type="pcre2">reference="([^"]+)",</regex>
34
  <order>YARA.reference</order>
35
</decoder>
36

37
<decoder name="YARA_child">
38
  <parent>YARA_decoder</parent>
39
  <regex type="pcre2">date="([^"]+)",</regex>
40
  <order>YARA.published_date</order>
41
</decoder>
42

43
<decoder name="YARA_child">
44
  <parent>YARA_decoder</parent>
45
  <regex type="pcre2">score =(\d+),</regex>
46
  <order>YARA.threat_score</order>
47
</decoder>
48

49
<decoder name="YARA_child">
50
  <parent>YARA_decoder</parent>
51
  <regex type="pcre2">customer="([^"]+)",</regex>
52
  <order>YARA.api_customer</order>
53
</decoder>
54

55
<decoder name="YARA_child">
56
  <parent>YARA_decoder</parent>
57
  <regex type="pcre2">hash1="([^"]+)",</regex>
58
  <order>YARA.file_hash</order>
59
</decoder>
60

61
<decoder name="YARA_child">
62
  <parent>YARA_decoder</parent>
63
  <regex type="pcre2">tags="([^"]+)",</regex>
64
  <order>YARA.tags</order>
65
</decoder>
66

67
<decoder name="YARA_child">
68
  <parent>YARA_decoder</parent>
69
  <regex type="pcre2">minimum_YARA="([^"]+)"\]</regex>
70
  <order>YARA.minimum_YARA_version</order>
71
</decoder>
72

73
<decoder name="YARA_child">
74
  <parent>YARA_decoder</parent>
75
  <regex type="pcre2">\] (.*) \|</regex>
76
  <order>YARA.scanned_file</order>
77
</decoder>
78

79
<!-- ChatGPT enrichment fields -->
80
<decoder name="YARA_child">
81
  <parent>YARA_decoder</parent>
82
  <regex type="pcre2">chatgpt_response: (.*)</regex>
83
  <order>YARA.chatgpt_response</order>
84
</decoder>
85

86
<decoder name="YARA_child">
87
  <parent>YARA_decoder</parent>
88
  <regex type="pcre2">Successfully deleted (.*)</regex>
89
  <order>YARA.file_deleted</order>
90
</decoder>
91

92
<decoder name="YARA_child">
93
  <parent>YARA_decoder</parent>
94
  <regex type="pcre2">Unable to delete (.*)</regex>
95
  <order>YARA.file_not_deleted</order>
96
</decoder>

1
<group name="syscheck,">
2
  <!-- Linux FIM Rules -->
3
  <rule id="100300" level="5">
4
    <if_sid>550</if_sid>
5
    <field name="file">/home</field>
6
    <description>File modified in /home directory.</description>
7
  </rule>
8

9
  <rule id="100301" level="5">
10
    <if_sid>554</if_sid>
11
    <field name="file">/home</field>
12
    <description>File added to /home directory.</description>
13
  </rule>
14

15
  <!-- Windows FIM Rules -->
16
  <rule id="100302" level="5">
17
    <if_sid>550</if_sid>
18
    <field name="file" type="pcre2">(?i)C:\\Users.+Downloads</field>
19
    <description>File modified in the downloads directory.</description>
20
  </rule>
21

22
  <rule id="100303" level="5">
23
    <if_sid>554</if_sid>
24
    <field name="file" type="pcre2">(?i)C:\\Users.+Downloads</field>
25
    <description>File added to the downloads directory.</description>
26
  </rule>
27
</group>
28

29
<group name="yara,">
30
  <!-- Base YARA Rules -->
31
  <rule id="108000" level="0">
32
    <decoded_as>YARA_decoder</decoded_as>
33
    <description>YARA grouping rule</description>
34
  </rule>
35

36
  <!-- Malware Detection with AI Enrichment -->
37
  <rule id="108001" level="10">
38
    <if_sid>108000</if_sid>
39
    <match>wazuh-YARA: INFO - Scan result: </match>
40
    <description>File "$(YARA.scanned_file)" is a positive match for YARA rule: $(YARA.rule_name)</description>
41
  </rule>
42

43
  <!-- Successful File Removal -->
44
  <rule id="108002" level="5">
45
    <if_sid>108000</if_sid>
46
    <field name="YARA.file_deleted">\.</field>
47
    <description>Active response successfully removed malicious file "$(YARA.file_deleted)"</description>
48
  </rule>
49

50
  <!-- Failed File Removal (Critical) -->
51
  <rule id="108003" level="12">
52
    <if_sid>108000</if_sid>
53
    <field name="YARA.file_not_deleted">\.</field>
54
    <description>Active response unable to delete malicious file "$(YARA.file_not_deleted)"</description>
55
  </rule>
56

57
  <!-- High-severity threats -->
58
  <rule id="108004" level="12">
59
    <if_sid>108001</if_sid>
60
    <field name="YARA.threat_score" type="pcre2">^[8-9]\d|^100$</field>
61
    <description>High-severity malware detected: $(YARA.rule_name) (Score: $(YARA.threat_score))</description>
62
    <group>high_severity,malware,</group>
63
  </rule>
64

65
  <!-- Ransomware detection -->
66
  <rule id="108005" level="14">
67
    <if_sid>108001</if_sid>
68
    <field name="YARA.tags" type="pcre2">ransomware|crypto|locker</field>
69
    <description>Ransomware detected: $(YARA.rule_name)</description>
70
    <group>ransomware,critical,</group>
71
  </rule>
72

73
  <!-- APT malware detection -->
74
  <rule id="108006" level="13">
75
    <if_sid>108001</if_sid>
76
    <field name="YARA.tags" type="pcre2">apt|nation|state</field>
77
    <description>APT malware detected: $(YARA.rule_name)</description>
78
    <group>apt,targeted_attack,</group>
79
  </rule>
80

81
  <!-- Banking trojan detection -->
82
  <rule id="108007" level="12">
83
    <if_sid>108001</if_sid>
84
    <field name="YARA.tags" type="pcre2">banking|trojan|stealer</field>
85
    <description>Banking trojan detected: $(YARA.rule_name)</description>
86
    <group>banking_trojan,credential_theft,</group>
87
  </rule>
88
</group>

1
<ossec_config>
2
  <!-- Linux YARA with ChatGPT -->
3
  <command>
4
    <name>yara_linux</name>
5
    <executable>yara.sh</executable>
6
    <extra_args>-yara_path /usr/local/bin -yara_rules /var/ossec/active-response/yara/rules/yara_rules.yar</extra_args>
7
    <timeout_allowed>no</timeout_allowed>
8
  </command>
9

10
  <!-- Windows YARA with ChatGPT -->
11
  <command>
12
    <name>yara_windows</name>
13
    <executable>yara.exe</executable>
14
    <timeout_allowed>no</timeout_allowed>
15
  </command>
16

17
  <!-- Active Response Triggers -->
18
  <active-response>
19
    <disabled>no</disabled>
20
    <command>yara_linux</command>
21
    <location>local</location>
22
    <rules_id>100300,100301</rules_id>
23
  </active-response>
24

25
  <active-response>
26
    <disabled>no</disabled>
27
    <command>yara_windows</command>
28
    <location>local</location>
29
    <rules_id>100302,100303</rules_id>
30
  </active-response>
31
</ossec_config>

1
{
2
  "timestamp": "2024-01-22T10:30:15.123Z",
3
  "agent": {
4
    "id": "001",
5
    "name": "ubuntu-endpoint"
6
  },
7
  "rule": {
8
    "id": "108001",
9
    "level": 10,
10
    "description": "File \"/home/user/mirai\" is a positive match for YARA rule: Mirai_Botnet_Generic"
11
  },
12
  "data": {
13
    "YARA": {
14
      "rule_name": "Mirai_Botnet_Generic",
15
      "rule_description": "Mirai IoT botnet malware targeting Linux systems",
16
      "chatgpt_response": "Mirai is a self-propagating botnet that primarily targets IoT devices running Linux. It spreads by brute-forcing default credentials and can launch devastating DDoS attacks. To mitigate: immediately isolate infected devices, change default credentials across all IoT devices, implement network segmentation, and deploy proper access controls.",
17
      "threat_score": "85",
18
      "tags": "botnet,iot,ddos,linux",
19
      "scanned_file": "/home/user/mirai",
20
      "file_deleted": "/home/user/mirai"
21
    }
22
  }
23
}

1
{
2
  "query": {
3
    "bool": {
4
      "must": [
5
        {"match": {"rule.groups": "yara"}},
6
        {"exists": {"field": "data.YARA.chatgpt_response"}}
7
      ],
8
      "filter": [
9
        {
10
          "range": {
11
            "@timestamp": {
12
              "gte": "now-24h"
13
            }
14
          }
15
        }
16
      ]
17
    }
18
  },
19
  "aggs": {
20
    "threat_scores": {
21
      "histogram": {
22
        "field": "data.YARA.threat_score",
23
        "interval": 10
24
      }
25
    }
26
  }
27
}

1
def create_enhanced_prompt(description, file_path, yara_metadata):
2
    """Create context-aware prompt for ChatGPT"""
3

4
    prompt = f"""
5
    Analyze this malware detection:
6

7
    Threat: {description}
8
    File Path: {file_path}
9
    Detection Metadata: {yara_metadata}
10

11
    Please provide:
12
    1. Technical analysis of the threat
13
    2. Potential impact and attack vectors
14
    3. Specific mitigation steps
15
    4. Recommended preventive measures
16

17
    Format the response as a structured analysis suitable for security operations.
18
    """
19

20
    return prompt

1
def query_multiple_models(description):
2
    """Query multiple AI models for comprehensive analysis"""
3

4
    models = {
5
        'gpt-4-turbo': 'technical_analysis',
6
        'gpt-3.5-turbo': 'quick_assessment',
7
        'claude-2': 'detailed_writeup'
8
    }
9

10
    responses = {}
11
    for model, purpose in models.items():
12
        response = query_ai_model(model, description, purpose)
13
        responses[purpose] = response
14

15
    return responses

1
import hashlib
2
import json
3
from datetime import datetime, timedelta
4

5
class ChatGPTCache:
6
    def __init__(self, cache_file='/tmp/chatgpt_cache.json', ttl_hours=24):
7
        self.cache_file = cache_file
8
        self.ttl = timedelta(hours=ttl_hours)
9
        self.cache = self.load_cache()
10

11
    def get_cache_key(self, description):
12
        """Generate cache key for description"""
13
        return hashlib.md5(description.encode()).hexdigest()
14

15
    def get_cached_response(self, description):
16
        """Get cached response if available and not expired"""
17
        key = self.get_cache_key(description)
18

19
        if key in self.cache:
20
            entry = self.cache[key]
21
            created = datetime.fromisoformat(entry['timestamp'])
22

23
            if datetime.now() - created < self.ttl:
24
                return entry['response']
25

26
        return None
27

28
    def cache_response(self, description, response):
29
        """Cache AI response"""
30
        key = self.get_cache_key(description)
31
        self.cache[key] = {
32
            'response': response,
33
            'timestamp': datetime.now().isoformat()
34
        }
35
        self.save_cache()
36

37
    def load_cache(self):
38
        """Load cache from file"""
39
        try:
40
            with open(self.cache_file, 'r') as f:
41
                return json.load(f)
42
        except (FileNotFoundError, json.JSONDecodeError):
43
            return {}
44

45
    def save_cache(self):
46
        """Save cache to file"""
47
        with open(self.cache_file, 'w') as f:
48
            json.dump(self.cache, f)

1
def track_enrichment_metrics():
2
    """Track ChatGPT enrichment metrics"""
3

4
    metrics = {
5
        'total_scans': 0,
6
        'enriched_alerts': 0,
7
        'api_failures': 0,
8
        'cache_hits': 0,
9
        'avg_response_time': 0,
10
        'cost_estimate': 0
11
    }
12

13
    # Calculate metrics from logs
14
    # Send to monitoring system
15
    return metrics

1
def assess_alert_quality(alert):
2
    """Assess the quality of AI-enriched alerts"""
3

4
    quality_score = 0
5

6
    # Check for AI response presence
7
    if 'chatgpt_response' in alert['data']['YARA']:
8
        quality_score += 40
9

10
    # Check response length and detail
11
    response = alert['data']['YARA'].get('chatgpt_response', '')
12
    if len(response) > 100:
13
        quality_score += 30
14

15
    # Check for actionable information
16
    actionable_terms = ['mitigate', 'prevent', 'isolate', 'remove', 'update']
17
    if any(term in response.lower() for term in actionable_terms):
18
        quality_score += 30
19

20
    return quality_score

1
def sanitize_for_ai(description):
2
    """Remove sensitive information from AI queries"""
3

4
    # Remove IP addresses
5
    description = re.sub(r'\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b', '[IP]', description)
6

7
    # Remove file paths
8
    description = re.sub(r'[A-Za-z]:\\[^\s]*', '[PATH]', description)
9
    description = re.sub(r'/[^\s]*', '[PATH]', description)
10

11
    # Remove potential usernames
12
    description = re.sub(r'user[_-]?\w+', '[USER]', description, flags=re.IGNORECASE)
13

14
    return description