Modify Full log

[Riccardo Olivetto]

Hi, i've created a custom active response script that use ChatGPT.
The active response script is called correctly, but the alert is generated without it's response. How can I add an additional field to see chatgpt response?

[Federico Ramos]

Hello, Active Response doesn't create new alerts; it's a script that runs based on certain alerts you've configured.

If you want to save the CHATGPT response, you should add a way to persist this data to your script.

[Riccardo Olivetto]

I refer to this article: https://documentation.wazuh.com/current/proof-of-concept-guide/leveraging-llms-for-alert-enrichment.html
The script itself doesn't add the field chatgpt responde, but from the visulization of alerts by GUI there is this additional field.

If i share with you my script can you help me?

[Luciano Valinotti]

Hi Riccardo
As the article you referred to shows, the 'chatgpt_response' field visible in the example GUI is populated when the script updates the alert. Active Response scripts themselves don’t automatically store the ChatGPT output in alert fields.

In this case, you would need to add logic in your script to write the response to a custom field, for example, to persist this data. You can find more details on how to update alerts programmatically in the Wazuh Indexer API documentation, and you might also explore some use cases and examples here.

 
While I’m not able to work on the script itself, I hope this information points you in the right direction.