AI Ops Assistant

1curl -G "https://api.flowlink.io/v1/ops/ask" \
2  --data-urlencode "q=which agents have high error rates?" \
3  -H "Authorization: Bearer $TOKEN" | jq

1{
2  "query": "which agents have high error rates?",
3  "answer": "Based on the last 24 hours, 2 agents have elevated error rates:\n\n1. **agent-prod-03** — 15 blocked commands, 3 high-risk events, risk score 72\n2. **agent-staging-01** — 8 blocked commands, risk score 55\n\nRecommendation: Review policy rules for agent-prod-03 and check error logs.",
4  "sources": [
5    { "type": "audit_log", "rows_retrieved": 45 },
6    { "type": "agent_metrics", "rows_retrieved": 12 }
7  ],
8  "confidence": 0.92,
9  "language": "en",
10  "processing_time_ms": 1200,
11  "timestamp": "2026-01-15T14:32:01Z"
12}

1{
2  "tool": "ops_ask",
3  "arguments": {
4    "query": "what changed on agent web-01 in the last hour?"
5  }
6}

1curl -X POST "https://api.flowlink.io/v1/ops/analyze" \
2  -H "Authorization: Bearer $TOKEN" \
3  -H "Content-Type: application/json" \
4  -d '{
5    "type": "incident",
6    "agent_id": "agent-prod-03",
7    "time_range": { "hours": 6 }
8  }'

1{
2  "analysis_id": "ana_abc123",
3  "agent_id": "agent-prod-03",
4  "time_range": { "from": "2026-01-15T08:30:00Z", "to": "2026-01-15T14:30:00Z" },
5  "summary": "Agent prod-03 experienced 3 high-risk events in the last 6 hours. Root cause appears to be a misconfigured deployment script that attempts sudo operations.",
6  "timeline": [
7    { "time": "2026-01-15T09:00:00Z", "event": "sudo apt-get upgrade", "risk": 35 },
8    { "time": "2026-01-15T11:00:00Z", "event": "chmod 777 /var/log", "risk": 72 },
9    { "time": "2026-01-15T13:00:00Z", "event": "rm -rf /tmp/deploy", "risk": 45 }
10  ],
11  "correlated_events": [
12    { "source": "policy_engine", "event": "3 policy violations" },
13    { "source": "risk_scores", "event": "risk score increased from 22 to 55" }
14  ],
15  "recommended_actions": [
16    "Review deployment script permissions",
17    "Add policy: deny chmod 777 * for env:production",
18    "Require approval for sudo operations"
19  ],
20  "confidence": 0.88
21}

1{
2  "correlation_rules": [
3    {
4      "name": "escalation_chain",
5      "description": "Group events showing privilege escalation pattern",
6      "match": {
7        "event_types": ["command_executed", "policy_violation"],
8        "time_window_seconds": 3600,
9        "same_agent": true,
10        "min_events": 3
11      },
12      "severity": "high"
13    },
14    {
15      "name": "resource_exhaustion",
16      "description": "Group metrics showing resource pressure",
17      "match": {
18        "event_types": ["health_degraded", "command_timeout"],
19        "time_window_seconds": 1800,
20        "same_agent": true,
21        "min_events": 2
22      },
23      "severity": "medium"
24    }
25  ]
26}

1# Пример runbook
2runbooks:
3  - name: "restart_nginx_high_error_rate"
4    description: "Restart nginx when error rate exceeds threshold"
5    trigger:
6      metric: "error_rate"
7      agent_tag: "role:web"
8      threshold: 10.0
9      window_seconds: 300
10    actions:
11      - type: "command"
12        command: "sudo systemctl restart nginx"
13        timeout_seconds: 30
14      - type: "notify"
15        channel: "telegram"
16        message: "Auto-restarted nginx on {{agent_id}} (error_rate: {{value}})"
17    post_check:
18      metric: "error_rate"
19      threshold: 1.0
20      timeout_seconds: 60
21    requires_approval: false
22    enabled: true
23
24  - name: "cleanup_disk"
25    description: "Clean up temporary files when disk usage is critical"
26    trigger:
27      metric: "disk_percent"
28      threshold: 95.0
29    actions:
30      - type: "command"
31        command: "sudo docker system prune -f"
32        timeout_seconds: 60
33      - type: "command"
34        command: "sudo journalctl --vacuum-time=3d"
35        timeout_seconds: 30
36    requires_approval: true
37    enabled: true

1# Список runbooks
2curl -s "https://api.flowlink.io/v1/ops/runbooks" \
3  -H "Authorization: Bearer $TOKEN" | jq
4
5# Ручной запуск runbook
6curl -X POST "https://api.flowlink.io/v1/ops/runbooks/restart_nginx_high_error_rate/execute" \
7  -H "Authorization: Bearer $TOKEN" \
8  -H "Content-Type: application/json" \
9  -d '{"agent_id": "agent-web-01", "reason": "manual trigger"}'

1{
2  "execution_id": "exec_abc123",
3  "runbook_name": "restart_nginx_high_error_rate",
4  "agent_id": "agent-web-01",
5  "status": "completed",
6  "actions_performed": [
7    { "action": "command", "command": "sudo systemctl restart nginx", "exit_code": 0, "duration_ms": 1200 },
8    { "action": "notify", "channel": "telegram", "status": "sent" }
9  ],
10  "post_check": { "metric": "error_rate", "value": 0.2, "passed": true },
11  "executed_at": "2026-01-15T14:30:00Z"
12}