Disclaimer: The perspectives shared here are my own and do not necessarily represent those of my employer. I use GenAI as a tool to help me compose and structure my articles.
In the cybersecurity landscape, small to medium-sized businesses (SMBs) often rely on security operations that are efficient, cost-effective, and do not require significant in-house expertise. One approach that could gain traction in these environments is Directed Security Operations using AI — a method where AI acts as a well-trained assistant, following human direction to execute specific, repetitive tasks. This is an ideal approach for SMBs because it allows them to augment their security capabilities without overhauling their infrastructure or making a major investment.
This article introduces Directed AI operations, discusses some benefits, and provides a practical use case where I use OpenAI’s API to generate AWS Web Application Firewall (WAF) rules. I’ll explore the concept and benefits of Directed AI and then delve into how AI can support the creation of WAF rules, followed by a Python code example that automates parts of this process. Please refer to this article for a general introduction and an overview of this and the other two levels in this proposed framework.
What are Directed AI Operations?
In Directed AI operations, the AI acts as an assistant, performing specific, pre-defined tasks under human direction. Unlike fully autonomous AI systems, Directed AI requires input and oversight from a human operator, ensuring it follows clear guidelines without deviating from intended outcomes. Directed AI is commonly applied to repetitive or data-intensive tasks, such as log filtering, anomaly detection, and in this case, WAF rule generation. Think of it as a step or task you need to carry out to achieve a business goal.
For SMBs, Directed AI offers several benefits:
- Efficiency: AI reduces the workload by automating tedious tasks, freeing up team members to focus on more complex issues. It may also remove the need to develop complex algorithms using traditional programming languages.
- Cost Savings: By relying on AI to perform these tasks, SMBs avoid hiring additional personnel or investing in costly enterprise security solutions.
- Risk Mitigation: Unlike autonomous AI, Directed AI allows human operators to oversee and approve actions, reducing the risk of unintended consequences.
A practical use case: automating WAF Rule Creation
When creating security rules for a WAF, many factors come into play. Directed AI can reduce the time spent on rule creation and validation while ensuring that the rules align with specific requirements.
Let’s walk through a practical example of using OpenAI’s API to help create an AWS WAF rule based on user input. In this scenario, we’ll request the user’s specifications for the rule, then let the AI generate the rule syntax. This use case isn’t trivial but is also not overly complex, making it a suitable task for Directed AI.
Our objective is to generate a rule based on simple requirements (e.g., “block all requests to endpoint X that contain a specific header”). For simplicity, we’ll use OpenAI’s API to interpret the user input and suggest a WAF rule. Note that we won’t be interfacing directly with AWS WAF; we’re focusing here on AI-assisted rule creation.
Python Code Example
This script accepts user input, sends it to OpenAI’s API to interpret and create a suggested WAF rule, and then returns the generated rule.
from openai import OpenAI
# Set up your OpenAI API key
OPENAI_API_KEY = "your_openai_api_key_here"
def get_waf_rule(description):
"""
Function that takes a user-provided description of a WAF rule
and requests OpenAI to generate a WAF rule suggestion based on it.
"""
client = OpenAI(api_key=OPENAI_API_KEY)
system_role_description = '''
You are a cybersecurity assistant tasked with creating AWS WAF rules.
Based on the user request, suggest a WAF rule in AWS syntax."
'''
completion = client.chat.completions.create(
model="gpt-4o",
messages=[
{
"role": "system",
"content": system_role_description
},
{
"role": "user",
"content": f"Provide the WAF rule syntax for the following user request:\n\n {description}"
}
],
temperature=0.3 # Lower temperature for more precise results
)
return completion.choices[0].message.strip()
# Main function to get input and display the AI-generated rule
def main():
print("Welcome to the WAF Rule Generator using AI.")
user_input = input("Describe the rule you want to create (e.g., 'block requests to /login with a specific cookie'):\n")
# Generate WAF rule using OpenAI
generated_rule = get_waf_rule(user_input)
# Display the result
print("\nGenerated WAF Rule:")
print(generated_rule)
if __name__ == "__main__":
main()
In this code, we ask the AI to generate a WAF rule based on a user description, specifying AWS syntax for clarity. We also set a low “temperature” parameter to ensure the output is focused and precise. OpenAI’s API processes the input description and provides a response based on the specified prompt, returning the text for a suggested WAF rule.
As it was mentioned above, I haven’t included the call to the WAF to get the rules updated with the new one, or a validation that the rule has been created without any syntax errors.
Example Output
Let’s say a user wants to block all requests to the /admin endpoint where the host header is example.com. The script would produce output similar to this:
User Request: block requests to the `/admin` endpoint where the `host` header is `example.com`
Generated WAF Rule:
...
{
"Name": "BlockRequestsToAdminWithHostExampleCom",
"Priority": 1,
"Action": {
"Block": {}
},
"Statement": {
"AndStatement": {
"Statements": [
{
"ByteMatchStatement": {
"FieldToMatch": {
"SingleHeader": {
"Name": "host"
}
},
"PositionalConstraint": "EXACTLY",
"SearchString": "example.com",
"TextTransformations": [
{
"Priority": 0,
"Type": "NONE"
}
]
}
},
{
"ByteMatchStatement": {
"FieldToMatch": {
"UriPath": {}
},
"PositionalConstraint": "EXACTLY",
"SearchString": "/admin",
"TextTransformations": [
{
"Priority": 0,
"Type": "NONE"
}
]
}
}
]
}
},
"VisibilityConfig": {
"SampledRequestsEnabled": true,
"CloudWatchMetricsEnabled": true,
"MetricName": "BlockRequestsToAdminWithHostExampleCom"
}
}
Final Thoughts
Leveraging Directed AI for WAF rule creation introduces an efficient and yet powerful method for automating firewall updates. This approach could lay the foundation for an AI agent specifically focused on generating and refining WAF rules. One can easily envision complementary AI agents that analyse anomalies or detect attack patterns, collaborating with the WAF rule agent to dynamically generate protective rules in response to emerging threats. Ultimately, achieving autonomous AI operations may involve orchestrating a network of specialised, directed agents — gradually empowering AI to make decisions on behalf of these components as they operate in concert.
In future articles, I’ll explore additional AI use cases for security operations, focusing on more advanced tasks and discussing methods to integrate AI-driven tools into your security ecosystem.