warren
AI-powered security alert management that reduces noise and accelerates response time
File Explorer
Download Latest Version (.zip)- alert-processing.md
- chat-strategy-naming.md
- documentation-updates.md
- frontend.md
- notifier-design.md
- repository-tests.md
- subagent-development.md
- SKILL.md
- SKILL.md
- cache-cleanup.yml
- codegen.yml
- e2e.yml
- gosec.yml
- lint.yml
- publish.yml
- release.yml
- test.yml
- trivy.yml
- gcp.md
- slack.md
- chat.png
- concept.png
- dashboard.png
- dashboard2.png
- logo.png
- logo2.png
- logo3.png
- slack.png
- ticket_detail.png
- v0.16.0.md
- v0.7.0.md
- alert-investigation.md
- chat-session-migration.md
- knowledge.md
- mcp.md
- policy.md
- api.md
- configuration.md
- aster.md
- bluebell.md
- README.md
- concepts.md
- getting-started.md
- crowdstrike_falcon.json
- defender_endpoint.json
- falco.json
- guardduty.json
- README.md
- scc.json
- mcp-config.yml
- .gitkeep
- auth.ts
- index.ts
- testData.ts
- api.ts
- AlertDetailPage.ts
- AlertListPage.ts
- BasePage.ts
- DashboardPage.ts
- KnowledgePage.ts
- QueuedAlertListPage.ts
- TicketDetailPage.ts
- TicketListPage.ts
- alert.spec.ts
- knowledge.spec.ts
- navigation.spec.ts
- queued-alert.spec.ts
- ticket.spec.ts
- zzz_ticket-conversation.spec.ts
- .gitignore
- favicon-192x192.png
- favicon-512x512.png
- favicon.ico
- file.svg
- globe.svg
- logo.png
- next.svg
- vercel.svg
- window.svg
- e2e.sh
- auth-guard.tsx
- login-page.tsx
- header.tsx
- main-layout.tsx
- sidebar.tsx
- alert-dialog.tsx
- avatar.tsx
- badge.tsx
- button.tsx
- card.tsx
- checkbox.tsx
- collapsible.tsx
- dialog.tsx
- dropdown-menu.tsx
- edit-conclusion-modal.tsx
- input.tsx
- label.tsx
- navigation-menu.tsx
- pagination.tsx
- popover.tsx
- resolve-info.tsx
- scroll-area.tsx
- select.tsx
- separator.tsx
- sheet.tsx
- sidebar.tsx
- skeleton.tsx
- slider.tsx
- tabs.tsx
- tag-selector.tsx
- textarea.tsx
- toast.tsx
- toaster.tsx
- tooltip.tsx
- user-name.tsx
- ConversationMainPane.tsx
- ConversationSidePane.tsx
- CreateTicketModal.tsx
- EditTagModal.tsx
- EditTicketModal.tsx
- HITLPanel.tsx
- MessageBubble.tsx
- SalvageModal.tsx
- SimilarTickets.tsx
- TicketConversation.tsx
- auth.ts
- auth-context.tsx
- use-confirm.tsx
- use-mobile.ts
- use-toast.tsx
- useWebSocket.ts
- tag-colors.test.ts
- generated.ts
- queries.ts
- apollo-client.ts
- tag-colors.ts
- types.ts
- user-profile-cache.ts
- utils-extended.ts
- utils.ts
- websocket-manager.ts
- websocket-types.ts
- AlertDetailPage.tsx
- AlertsPage.tsx
- Dashboard.tsx
- DiagnosisDetailPage.tsx
- DiagnosisPage.tsx
- KnowledgeDetailPage.tsx
- KnowledgeEditPage.tsx
- KnowledgePage.tsx
- KnowledgeTagsPage.tsx
- NotFoundPage.tsx
- QueuedAlertsPage.tsx
- SessionDetailPage.tsx
- SettingsPage.tsx
- TicketDetailPage.tsx
- TicketsPage.tsx
- auth.ts
- App.tsx
- globals.css
- main.tsx
- .gitignore
- .npmrc
- codegen.ts
- components.json
- eslint.config.mjs
- index.html
- package.json
- playwright.config.ts
- pnpm-lock.yaml
- pnpm-workspace.yaml
- postcss.config.mjs
- static.go
- tailwind.config.js
- tsconfig.json
- tsconfig.node.json
- vite.config.ts
- schema.graphql
- sample.rego
- export_test.go
- file_source.go
- file_source_test.go
- github_source.go
- github_source_test.go
- loader.go
- loader_test.go
- source.go
- client.go
- client_test.go
- memory.go
- memory_test.go
- mock.go
- mock_test.go
- repository.go
- repository_test.go
- base.md
- runbooks.md
- system_with_memories.md
- tool_description.md
- failed_logins.sql
- failed_logins.sql
- suspicious_access.sql
- config_with_runbooks.yaml
- example_config.yaml
- agent.go
- agent_test.go
- config.go
- config_test.go
- export_test.go
- factory.go
- prompt.go
- prompt_test.go
- README.md
- runbook.go
- tool.go
- tool_test.go
- extract.md
- system.md
- agent.go
- auth.go
- auth_test.go
- export_test.go
- extract.go
- factory.go
- prompt.go
- README.md
- tool.go
- tool_test.go
- extract.md
- system.md
- agent.go
- agent_test.go
- export_test.go
- extract.go
- factory.go
- prompt.go
- prompt_test.go
- README.md
- tool.go
- tool_helper_test.go
- tool_test.go
- agents.go
- factory.go
- sample.rego
- data.json
- data.json
- multi_objects.jsonl
- data.json
- multi_objects.jsonl
- async.go
- async_test.go
- circuitbreaker.go
- claude.go
- composite_llm.go
- composite_llm_test.go
- export_test.go
- firestore.go
- firestore_test.go
- gemini.go
- genai.go
- llm.go
- logger.go
- mcp.go
- mcp_test.go
- noop_llm.go
- policy.go
- policy_test.go
- sentry.go
- slack.go
- storage.go
- storage_test.go
- strategy_system_prompts.go
- strategy_system_prompts_test.go
- testdata.go
- testdata_test.go
- trace.go
- user_system_prompt.go
- user_system_prompt_test.go
- web_ui.go
- web_ui_test.go
- alert.go
- alert_test.go
- chat.go
- cli.go
- export_test.go
- migrate.go
- migrate_chat_session.go
- migrate_test.go
- refine.go
- serve.go
- serve_test.go
- test.go
- tool.go
- utils.go
- utils_test.go
- dataloader.go
- dataloader_test.go
- diagnosis_resolver.go
- export_test.go
- generated.go
- helpers.go
- hitl.go
- resolver.go
- resolver_test.go
- schema.resolvers.go
- schema.resolvers_test.go
- similar_tickets_helper.go
- pubsub.json
- slack_interaction.json
- slack_mention.json
- sns.har
- sns.pem.txt
- alert.go
- alert_test.go
- auth.go
- auth_test.go
- error.go
- export_test.go
- graphql_test.go
- interfaces.go
- interfaces_test.go
- logger.go
- middleware.go
- middleware_test.go
- mock_test.go
- server.go
- server_test.go
- slack.go
- user.go
- websocket_test.go
- export_test.go
- slack.go
- slack_test.go
- sync.go
- events.go
- events_test.go
- export_test.go
- handler.go
- handler_test.go
- hitl_view.go
- hub.go
- hub_test.go
- test_helpers.go
- notification.go
- adaptor.go
- chat.go
- chat_usecase.go
- clients.go
- errors.go
- notifier.go
- prompt.go
- repository.go
- session_notifier.go
- tool.go
- toolset.go
- usecase.go
- web_event_publisher.go
- interfaces.go
- activity.go
- alert_meta.md
- list_meta.md
- list_summary.md
- alert.go
- alert_test.go
- export_test.go
- list.go
- queued.go
- reprocess_batch.go
- async.go
- auth.go
- context.go
- token.go
- token_test.go
- runbook.go
- context.go
- diagnosis.go
- models_gen.go
- request.go
- request_test.go
- knowledge.go
- knowledge_test.go
- context.go
- lang.go
- sns.har
- sns.pem.txt
- mock_test.go
- pubsub.go
- sns.go
- sns_test.go
- notice.go
- enrich.go
- enrich_test.go
- policy.go
- policy_test.go
- testdata.go
- triage.go
- triage_test.go
- prompt.go
- prompt_test.go
- schema.go
- schema_test.go
- group.go
- author.go
- lock.go
- message.go
- message_test.go
- session.go
- session_test.go
- source.go
- turn.go
- turn_test.go
- blocks.go
- history.go
- parser.go
- parser_test.go
- slack.go
- slack_test.go
- test_helper.go
- verify.go
- helpers.go
- helpers_test.go
- tag.go
- ticket_meta.md
- comment.go
- ticket.go
- ticket_test.go
- message.go
- message_test.go
- activity.go
- alert.go
- chat.go
- diagnosis.go
- genai.go
- genai_test.go
- hitl.go
- knowledge.go
- knowledge_test.go
- knowledge_types.go
- queued_alert.go
- refine.go
- runbook.go
- session.go
- tag.go
- ticket.go
- turn.go
- helper.go
- activity.go
- alert.go
- auth.go
- diagnosis.go
- export.go
- firestore.go
- hitl.go
- knowledge_v2.go
- notice.go
- refine.go
- session.go
- session_v2.go
- tag.go
- throttle.go
- ticket.go
- activity.go
- alert.go
- auth.go
- diagnosis.go
- hitl.go
- knowledge_v2.go
- memory.go
- notice.go
- refine.go
- session.go
- session_v2.go
- tag.go
- throttle.go
- ticket.go
- activity_helper.go
- activity_test.go
- alert_test.go
- auth_test.go
- compat_firestore.go
- compat_memory.go
- diagnosis_test.go
- hitl_test.go
- notice_test.go
- refine_test.go
- session_message_test.go
- session_test.go
- tag_test.go
- testutil_test.go
- throttle_test.go
- ticket_test.go
- circuitbreaker.go
- circuitbreaker_test.go
- abort.go
- abort_test.go
- core.go
- ticket.go
- ticket.help.md
- ticket_test.go
- purge.go
- purge_test.go
- service.go
- service.go
- service_test.go
- reflection_fact.md
- reflection_technique.md
- bm25.go
- bm25_test.go
- reflection.go
- search.go
- search_test.go
- service.go
- service_test.go
- schema.json
- ask.go
- ask_test.go
- middleware.go
- middleware_test.go
- summary.go
- summary_test.go
- helper.go
- helper_test.go
- chatnotifier_test.go
- cli.go
- ctx.go
- factory.go
- noop.go
- slack.go
- web.go
- console.go
- slack.go
- service.go
- service_test.go
- prompt.go
- prompt_test.go
- lock.go
- lock_test.go
- resolver.go
- resolver_test.go
- recorder.go
- recorder_test.go
- blocks.go
- blocks_test.go
- export_test.go
- history.go
- history_test.go
- hitl.go
- slack.go
- slack_test.go
- updater.go
- updater_test.go
- service.go
- service_test.go
- session_history.go
- session_history_test.go
- service.go
- service_test.go
- action.go
- action_test.go
- README.md
- action.go
- alert.go
- search_session_messages.go
- search_session_messages_test.go
- ticket.go
- ticket_session_messages.go
- ticket_session_messages_test.go
- ticket_test.go
- bigquery_prompt.md
- generate_config.md
- activity_schema.json
- config.yml
- large_schema_example.yaml
- sample_security_schema.yaml
- schema.json
- convert.go
- export_test.go
- helper.go
- helper_test.go
- interfaces.go
- mock.go
- prompt.go
- runbook_loader.go
- runbook_loader_test.go
- schema.go
- schema_test.go
- tool.go
- tool_test.go
- validation.go
- validation_test.go
- config.yaml
- action.go
- action_test.go
- README.md
- types.go
- action.go
- action_test.go
- export_test.go
- README.md
- action.go
- action_test.go
- README.md
- tool.go
- tool_test.go
- action.go
- action_test.go
- README.md
- action.go
- action_test.go
- README.md
- action.go
- action_test.go
- export_test.go
- README.md
- action.go
- action_test.go
- README.md
- action.go
- action_test.go
- README.md
- action.go
- action_test.go
- export_test.go
- llmflag.go
- llmflag_test.go
- README.md
- action.go
- action_test.go
- README.md
- final.md
- plan.md
- replan.md
- system.md
- task.md
- ticketless_system.md
- aster.go
- aster_test.go
- budget.go
- budget_test.go
- errors.go
- exec.go
- export_test.go
- hitl.go
- hitl_test.go
- model.go
- model_test.go
- plan.go
- plan_test.go
- prompt.go
- final.md
- plan.md
- replan.md
- selector.md
- system.md
- task.md
- bluebell.go
- bluebell_test.go
- budget.go
- errors.go
- exec.go
- export_test.go
- hitl.go
- model.go
- plan.go
- plan_test.go
- prompt.go
- prompt_test.go
- selector.go
- selector_test.go
- auth.go
- behavior_test.go
- errors.go
- history.go
- history_test.go
- sink.go
- sink_cli.go
- sink_slack.go
- sink_test.go
- sink_web.go
- usecase.go
- binding_mismatch.go
- legacy_alert_status.go
- legacy_knowledge.go
- legacy_ticket_status.go
- missing_alert_metadata.go
- missing_embedding.go
- orphaned_tag_id.go
- rule.go
- bundle_v0_16_0_test.go
- comment_to_message.go
- comment_to_message_test.go
- history_scope.go
- history_scope_test.go
- migration.go
- migration_test.go
- session_consolidate.go
- session_consolidate_test.go
- session_source_backfill.go
- session_source_backfill_test.go
- turn_synthesis.go
- turn_synthesis_test.go
- alert_system_prompt.md
- refine_alert_consolidation.md
- refine_alert_summary.md
- refine_ticket_review_exec.md
- refine_ticket_review_plan.md
- resolve_message.md
- ticket_comment.md
- ticket_from_conversation.md
- p1.rego
- p2.rego
- p4.rego
- p1.rego
- p3.rego
- p4.rego
- alert1.json
- alert2.json
- alert3.json
- detect.json
- ignore.json
- new.json
- test.rego
- auth_allow.rego
- auth_deny.rego
- auth_user_based.rego
- test_prompt.tmpl
- slack_trace_chain.json
- bot_message_skipped.json
- no_ticket_for_thread.json
- user_message_saved.json
- question_presenter.json
- tool_approval_presenter.json
- construction.json
- post_comment.json
- post_context_block.json
- post_finding.json
- post_link_to_ticket.json
- post_resolve_details.json
- post_session_actions.json
- reply_simple.json
- trace_accumulate_then_overflow.json
- updatable_trace_chain.json
- enrich_inline_prompt.rego
- enrich_no_id.rego
- enrich_no_tasks.rego
- enrich_query_task.rego
- guardduty.json
- ingest_no_title.rego
- ingest_test.rego
- triage_basic.rego
- triage_publish_alert.rego
- triage_publish_discard.rego
- triage_publish_notice.rego
- triage_simple.rego
- alert.go
- alert_pipeline.go
- alert_pipeline_test.go
- alert_test.go
- api.go
- auth.go
- auth_cache.go
- auth_cache_test.go
- auth_interface.go
- auth_test.go
- authn_noauthn.go
- authn_noauthn_test.go
- chat.go
- chat_test.go
- diagnosis.go
- diagnosis_test.go
- export_test.go
- generate_comment_test.go
- mock.go
- refine.go
- refine_test.go
- slack_app_mention.go
- slack_app_mention_test.go
- slack_golden_test.go
- slack_helper.go
- slack_itx_block.go
- slack_itx_block_comment_test.go
- slack_itx_block_test.go
- slack_itx_submit.go
- slack_itx_submit_test.go
- slack_message.go
- slack_message_test.go
- slack_session_lock_test.go
- tag.go
- tag_test.go
- ticket.go
- ticket_test.go
- usecase.go
- usecase_test.go
- context.go
- context_test.go
- dispatch.go
- dispatch_test.go
- builder.go
- builder_test.go
- context.go
- context_test.go
- subject.go
- context.go
- context_test.go
- dryrun.go
- dryrun_test.go
- embedding.go
- embedding_test.go
- errors.go
- handle.go
- handle_test.go
- keys.go
- tags.go
- llmclient.go
- llmclient_test.go
- context.go
- logger.go
- logger_test.go
- converter.go
- converter_test.go
- export_test.go
- parser.go
- renderer.go
- tokenizer.go
- msg.go
- msg_test.go
- ptr.go
- request_id.go
- io.go
- context.go
- context_test.go
- slackctx.go
- slackctx_test.go
- env.go
- llm.go
- reflect.go
- toolset.go
- toolset_test.go
- context.go
- .gitignore
- .trivyignore
- CLAUDE.md
- Dockerfile
- go.mod
- go.sum
- gqlgen.yml
- LICENSE
- main.go
- README.md
- Taskfile.yml
# Installation Guide
1. Get the code
git clone https://github.com/secmon-lab/warren
Downloads the entire project code from GitHub to your computer.
cd warren
Moves into the project folder you just downloaded.
2. Docker
Easy RecommendedPrerequisites
- Git Needed to download the project code from GitHub.
- Docker Desktop Needed to build and run containers. Install it and keep it running in the background.
docker run -d -p 8080:8080 \
Runs the built image as an actual container.
Run docker compose ps to check the containers are Up. If the README mentions a port, open http://localhost:PORT in your browser.
Pulled directly from this repo's README.
3. Node.js
EasyPrerequisites
cd frontend
This project's files live in a subfolder, so move into it first.
npm install
Downloads and installs the libraries listed in package.json.
npm start
Starts the development/run server.
After running the command, open the address shown in the terminal (usually something like http://localhost:3000) in your browser.
4. Go
MediumPrerequisites
go build ./...
Compiles the Go program into an executable.
go run .
Runs the Go program directly without a separate build step.
If the build finishes without errors, it worked. If you used go run ., check the terminal output.
// repository documentation
Was this content helpful?
(0 ratings)