VBAF.Enterprise.AlertRouter.ps1
|
#Requires -Version 5.1 <# .SYNOPSIS Pillar 6 - Enterprise Scripting: Intelligent Alert Router .DESCRIPTION Trains a DQN agent to classify and route Windows Event Log alerts. The agent observes real event log severity and learns when to: - Ignore : low severity events (action 0) - Log : medium events worth recording (action 1) - Alert : high severity needing attention (action 2) - Escalate : critical events requiring immediate action (action 3) .NOTES Part of VBAF - Phase 9 Enterprise Automation Engine Pillar 6: Enterprise Scripting with Intelligence PS 5.1 compatible #> # ============================================================ # PILLAR 6 - ENTERPRISE SCRIPTING: ALERT ROUTER # ============================================================ function Invoke-VBAFAlertRouterTraining { param( [int] $Episodes = 50, [int] $PrintEvery = 10, [switch] $FastMode, [switch] $SimMode ) Write-Host "" Write-Host "🏢 VBAF Enterprise - Pillar 6: Enterprise Scripting" -ForegroundColor Cyan Write-Host " Training DQN agent on Alert Router..." -ForegroundColor Cyan Write-Host " Actions: 0=Ignore 1=Log 2=Alert 3=Escalate" -ForegroundColor Yellow Write-Host " Goal : match action to event severity" -ForegroundColor Yellow Write-Host "" $arEnv = New-EnterpriseEnvironment -Name "AlertRouter" Write-Host " Phase 1: Baseline (random agent)..." -ForegroundColor Gray $baseline = Invoke-VBAFBenchmark -Environment $arEnv -Episodes 10 -Label "Baseline Random" if ($FastMode) { $Episodes = [Math]::Min($Episodes, 30) } if ($SimMode) { Write-Host "" Write-Host " Phase 2: Training DQN agent ($Episodes episodes - SimMode fast)..." -ForegroundColor Gray } else { Write-Host "" Write-Host " Phase 2: Training DQN agent ($Episodes episodes)..." -ForegroundColor Gray } # Build DQN - 4 state, 4 actions $config = [DQNConfig]::new() $config.StateSize = 4 # severity, frequency, timeOfDay, repeatCount $config.ActionSize = 4 # Ignore, Log, Alert, Escalate $config.EpsilonDecay = 0.9995 $config.EpsilonMin = 0.05 [int[]] $arch = @(4, 16, 16, 4) $mainNetwork = [NeuralNetwork]::new($arch, $config.LearningRate) $targetNetwork = [NeuralNetwork]::new($arch, $config.LearningRate) $memory = [ExperienceReplay]::new($config.MemorySize) $agent = [DQNAgent]::new($config, $mainNetwork, $targetNetwork, $memory) $results = [System.Collections.Generic.List[object]]::new() for ($ep = 1; $ep -le $Episodes; $ep++) { if ($SimMode) { # Real Windows events: 60% low, 30% medium, 10% high/critical $sevRoll = Get-Random -Minimum 1 -Maximum 100 if ($sevRoll -le 60) { $arEnv.Severity = [double](Get-Random -Minimum 0 -Maximum 20) / 100.0 } elseif ($sevRoll -le 90) { $arEnv.Severity = [double](Get-Random -Minimum 20 -Maximum 60) / 100.0 } else { $arEnv.Severity = [double](Get-Random -Minimum 60 -Maximum 100) / 100.0 } $arEnv.Frequency = [double](Get-Random -Minimum 0 -Maximum 100) / 100.0 $arEnv.TimeOfDay = [double]([System.DateTime]::Now.Hour) / 23.0 $arEnv.RepeatCount = Get-Random -Minimum 0 -Maximum 5 $arEnv.CorrectRoutes = 0 $arEnv.MissedAlerts = 0 $arEnv.Steps = 0 $arEnv.TotalReward = 0.0 $arEnv.EpisodeCount++ $state = $arEnv.GetState() } else { $state = $arEnv.Reset() } $done = $false $epReward = 0.0 $ignoreCount = 0 $logCount = 0 $alertCount = 0 $escalateCount = 0 [int] $stepCount = 0 while (-not $done) { $action = $agent.Act($state) $result = $arEnv.Step($action) $agent.Remember($state, $action, $result.Reward, $result.NextState, $result.Done) $stepCount++ if ($stepCount % 4 -eq 0) { $agent.Replay() } $state = $result.NextState $done = $result.Done $epReward += $result.Reward switch ($action) { 0 { $ignoreCount++ } 1 { $logCount++ } 2 { $alertCount++ } 3 { $escalateCount++ } } } $agent.EndEpisode($epReward) $results.Add(@{ Episode = $ep Reward = $epReward Ignore = $ignoreCount Log = $logCount Alert = $alertCount Escalate = $escalateCount Epsilon = $agent.Epsilon }) if ($ep % $PrintEvery -eq 0) { $lastN = $results | Select-Object -Last $PrintEvery $avgSum = 0.0 foreach ($r2 in $lastN) { $avgSum += $r2.Reward } $avg = [Math]::Round($avgSum / $lastN.Count, 2) Write-Host (" Ep {0,4}/{1} AvgReward: {2,7} Eps: {3:F3} Ign:{4} Log:{5} Alt:{6} Esc:{7}" -f $ep, $Episodes, $avg, $agent.Epsilon, $ignoreCount, $logCount, $alertCount, $escalateCount) -ForegroundColor White } } Write-Host "" Write-Host " Phase 3: Final evaluation..." -ForegroundColor Gray $trained = Invoke-VBAFBenchmark -Agent $agent -Environment $arEnv -Episodes 10 -Label "Trained DQN" $bAvg = [Math]::Round($baseline.Avg, 2) $tAvg = [Math]::Round($trained.Avg, 2) $improvement = if ($bAvg -ne 0) { [Math]::Round((($tAvg - $bAvg) / [Math]::Abs($bAvg)) * 100, 1) } else { 0 } Write-Host "" Write-Host "╔══════════════════════════════════════════════╗" -ForegroundColor Cyan Write-Host "║ Pillar 6: Alert Router - Results ║" -ForegroundColor Cyan Write-Host "╠══════════════════════════════════════════════╣" -ForegroundColor Cyan Write-Host ("║ Baseline (random) avg reward : {0,8} ║" -f $bAvg) -ForegroundColor Gray Write-Host ("║ Trained (DQN) avg reward : {0,8} ║" -f $tAvg) -ForegroundColor Green Write-Host ("║ Improvement : {0,7}% ║" -f $improvement) -ForegroundColor Yellow Write-Host "╠══════════════════════════════════════════════╣" -ForegroundColor Cyan Write-Host "║ Agent learned to: ║" -ForegroundColor Cyan Write-Host "║ Ignore low severity events ║" -ForegroundColor White Write-Host "║ Log medium severity events ║" -ForegroundColor White Write-Host "║ Alert high severity events ║" -ForegroundColor White Write-Host "║ Escalate critical events immediately ║" -ForegroundColor White Write-Host "╚══════════════════════════════════════════════╝" -ForegroundColor Cyan Write-Host "" return @{ Agent = $agent; Results = $results; Baseline = $baseline; Trained = $trained } } # ============================================================ # TEST SUGGESTIONS # ============================================================ # 1. Run VBAF.LoadAll.ps1 # 2. QUICK DEMO # $r = Invoke-VBAFAlertRouterTraining -Episodes 50 -PrintEvery 10 -SimMode # 3. FULL TRAINING (real Windows event logs) # $r = Invoke-VBAFAlertRouterTraining -Episodes 50 -PrintEvery 10 # 4. INSPECT DECISIONS # $env = New-EnterpriseEnvironment -Name "AlertRouter" # $state = $env.Reset() # Write-Host "Severity: $($env.Severity) Frequency: $($env.Frequency)" # $action = $r.Agent.Act($state) # $labels = @("Ignore","Log","Alert","Escalate") # Write-Host "Agent decision: $($labels[$action])" # ============================================================ Write-Host "📦 VBAF.Enterprise.AlertRouter.ps1 loaded [v3.0.0 🏢]" -ForegroundColor Green Write-Host " Pillar 6 : Enterprise Scripting with Intelligence" -ForegroundColor Cyan Write-Host " Function : Invoke-VBAFAlertRouterTraining" -ForegroundColor Cyan Write-Host "" Write-Host " Quick start:" -ForegroundColor Yellow Write-Host ' $r = Invoke-VBAFAlertRouterTraining -Episodes 50 -PrintEvery 10 -SimMode' -ForegroundColor White Write-Host "" |