Rebrand Dashboard Assistant UI in installer and add GIF demos to README (#85)

* Ansible+Wazuh_AR-Integration

* Gemini-Ai_integration

* Update README.md

Updated the script name from .txt to .py

* gemini_ai

Updated folder name and added Wazuh manager version details.

* Delete integrations/gemini_ai+wazuh directory

* custom-dashboard-pdf-email-report sending integration

* custom-dashboard-pdf-email-report sending integration

* Update README.md

* Update README.md

* Update README.md

Added more screenshots.

* Enrich the alerts with Gemini AI

This guide explains how to integrate Wazuh with Gemini AI to automatically enrich alerts with detailed explanations and suggested remediation steps in same alert.

* Delete integrations/gemini_ai_enrich-2.0/image-1.png

* folder name changed

folder name changed from gemini-ai-2.o to gemini_ai-opensearch

* Wazuh same alerts enrichment

Wazuh same alerts enrichment using MISP IOC data.

* Copilot change request update.

Prevented Timing Attacks (Comment 12): Replaced standard string comparisons with hmac.compare_digest() in the Flask enricher to securely validate the WEBHOOK_SECRET.

Network Attack Surface (Comment 10): Bound the Flask webhook directly to localhost (127.0.0.1) rather than all network interfaces (0.0.0.0), restricting access exclusively to local Wazuh/OpenSearch monitors. However, since your OpenSearch instance is connecting to the Wazuh server via its network IP (x.x.x.x), the Flask app (now only listening strictly on localhost) immediately blocked the incoming connection!

Systemd Service Hardening (Comments 1-7 & 15): Secured both the misp-enricher.service and misp-fetcher.service by moving them off the root user to least-privilege accounts (like wazuh and wazuh-ioc). Added modern systemd protections (NoNewPrivileges, ProtectSystem=strict, PrivateTmp, ProtectHome), while explicitly configuring ReadWritePaths so the scripts can still securely write their local .db files.

Secret Management (Comment 11): Eliminated hardcoded placeholder secrets from the README.md monitor payload and updated .env.example, providing clear instructions on securely syncing a custom WEBHOOK_SECRET between the OpenSearch monitor and the Python environment.

Enrichment Logic & Accuracy
CIDR & IP Range Support (Comments 1-7): Upgraded the SQLite database schemas and querying logic to properly ingest, index, and match IP ranges/CIDR blocks directly from MISP, rather than just exact IP matches.

Domain Normalization Sync (Comment 14): Duplicated the registrable_suffix and norm_domain functions from the fetcher into the enricher (along with the REG_ROOT_ONLY variable). This guarantees that the domains the webhook searches for are formatted exactly the same way they were saved in the database, eliminating missed subdomain hits.

Accurate Attribution (Comment 13): Changed the default fallback source label for matched IOCs in the OpenSearch payload from "OTX" to "MISP".

Deterministic Tagging (Comments 1-7): Forced the Python enricher to chronologically or alphabetically sort MISP tags before appending them to the OpenSearch payload. This prevents Elasticsearch/OpenSearch indexing conflicts caused by arrays changing order randomly.

Code Quality & Reliability
Robust Environment Parsing (Comment 8): Fixed the custom .env file loader in the fetcher script so it properly strips surrounding single/double quotes. This prevents the quotes from literally being injected into URL strings and booleans.

OpenSearch Update Logic (Comments 1-7): Refined how the Python script constructs and pushes document updates to the OpenSearch REST API, improving handling for missing documents or bulk timeouts.

Cleaned up Tech Debt (Comment 9): Removed several imported modules (urlparse) and configuration variables (MAX_PER_SET, SKIP_URL_IP, TYPE_CIDR) that were defined but never actually utilized by the fetcher script.

* Expand AI Assistant capabilities to take actions.

Now the Ai assistant can do actions like, agent management, custom dashboard creation, pdf report generation and send etc.

* Update README.md

* Updated readme.md file

* Updated clone command on readme.md file.

* Delete architecture.png

* Updated the scripts based on Copilot and added alerting option and assisted installation & configuration support

Updated the report generation functionality and README.md files based on Copilot change requests.

Also added OpenSearch alert creation functionality and optimized the dashboard creation process.

Additionally, implemented an assisted installation and configuration script to avoid manual configuration steps and simplify the deployment process.

* Update README.md

* Assistant script updated for distributed deployment also

* Update install_ai_assistant.sh

* Fix auto-mapping compatibility and intent detection

* Add wkhtmltopdf dependency and harden LLM intent JSON parsing

* Fix json parsing for dashboard arrays and add JSON strictness to prompts

* Fix python string syntax for prompt instructions

* Fix dashboard grid layout gaps and stop field hallucinations

* Fix SyntaxError in dashboard_plan.py and update base64 payload

* Update ALERT_PROMPT to make alert query generation broader and more accurate

* Fix WizardState unexpected keyword argument error by adding kind field

* Remove 0 hits confirmation prompt to reduce friction

* Fix disambiguation loop in auto index selection prompt

* Fix date mapping query_string exception with lenient flag

* Fix PDF report date mapping exception by adding lenient flag to fetch_report_data query

* Fix KQL wildcard exception by forbidding field:* queries in report prompt

* Fix too_many_nested_clauses exception by removing data.* from query_string fields

* Changed Wazuh manager username

Updated the Wazuh manager API username to default username.

* Updated the readme.md file.

Public IP to Indexer server IP.

* Updated the git url

* Added auto Wazuh labeling option.

* Delete integrations/AI_assistant/images/image-1.png

* Add files via upload

* Update README.md

* Delete integrations/AI_assistant/images/image-5.png

* Delete integrations/AI_assistant/images/image-4.png

* Delete integrations/AI_assistant/images/image-6.png

* Delete integrations/AI_assistant/images/image-3.png

* Delete integrations/AI_assistant/images/image.png

* Delete integrations/AI_assistant/images/image-10.png

* Add files via upload

* Enhance README with video demonstrations and introduce Wazuh assistant auto-labeling

## Overview
This Pull Request introduces significant improvements to the repository's documentation by replacing static image examples with dynamic video demonstrations. Additionally, it enhances the deployment automation by introducing Wazuh auto-labeling capabilities directly within the installation script.
## Changes Made
### 1. Documentation Enhancements: Video Demonstrations 🎥
To provide users with a clearer, more interactive understanding of the AI Assistant's capabilities, all static screenshot examples in the `README.md` have been replaced with high-quality video demonstrations (`.mp4` format). This makes it much easier to observe the expected workflows and conversational interactions in real-time.
Specific sections updated with video embeds include:
- **Threat Hunting**: Visualizing alert summaries and AI-driven analysis.
- **DQL (Data Query Language)**: Demonstrating natural-language to structured OpenSearch query conversions.
- **Agent Management**: Showcasing administrative tasks like restarting, removing, or assigning agents to groups.
- **Dashboard Creation**: Illustrating the prompt-based generation of custom visual dashboards.
- **IT Hygiene & Vulnerability Checks**: Showing how the assistant retrieves OS details, software inventory, and CVE status.
- **Generate Report**: Demonstrating the automated generation and email delivery of comprehensive PDF reports.
- **Indexer Monitor**: Showing the creation of Wazuh indexer monitors and automated alerts.
### 2. Feature Addition: Wazuh Auto-Labeling via Installation Script 🏷️
The automated setup process has been enhanced to support **Wazuh Auto-Labeling**.
- **What it does:** The `install_ai_assistant.sh` script now automatically configures and applies the necessary categorization labels directly during the installation phase.

* Update README.md

* Updated Video link

* Updated video urls

* Update README.md 

The DEPLOYMENT_TYPE description is grammatically unclear and harder to scan than the previous wording. This is an important setup variable, so it should be concise and unambiguous (all-in-one vs distributed indexer/dashboard nodes).

* Replace demo videos with GIFs and harden dashboard assistant patch step

- Replace the eight committed .mp4 demo videos with animated .gif demos
  embedded directly in the README (the .mp4 files were unreferenced; the
  README previously pointed at external user-attachments URLs)
- Skip the dashboard assistant UI patch with a warning when perl is not
  installed, instead of aborting mid-install under set -e
- Verify the rebranding substitutions matched the plugin bundle and warn
  when they did not, instead of logging success unconditionally

* Document ai-assistant.env variables in a reference table

Replace the short bullet list of environment variables with a table
describing each variable, what it controls, and an example value,
matching the mcp-llm-gateway.env template and the gateway's accepted
LLM_PROVIDER values.

---------

Co-authored-by: AI Assistant Bot <bot@example.com>

Author: bonyjohn05

integrations/AI_assistant/README.md

@@ -101,12 +101,31 @@ The installation and configuration of all components (System Preparation, OpenSe
    ```
 
    **Important Environment File Variables:**
-   - `DEPLOYMENT_TYPE`: Set to `"all-in-one"` (default), `"indexer"`, or `"dashboard"` depending on the node you are installing on.
-   - `WAZUH_INDEXER_IP`: Set to `127.0.0.1` if installing directly on the indexer, or its IP if distributed.
-   - `WAZUH_INDEXER_PUBLIC_IP`: The IP of your indexer server (used for PDF generation links).
-   - `WAZUH_MANAGER_IP` & `WAZUH_DASHBOARD_IP`: The IP addresses of your Wazuh Manager and Dashboard servers.
-   - `OPENAI_API_KEY` / `GEMINI_API_KEY` / AWS Credentials: Add your preferred LLM provider credentials.
-   - Update the respective `..._USER` and `..._PASS` fields with your actual Wazuh credentials.
+
+   The following table describes the variables you configure before running the installer script. The remaining variables in the file have working defaults for a single-host deployment.
+
+   | Variable | Description | Example value |
+   |---|---|---|
+   | `DEPLOYMENT_TYPE` | Defines which components the installer configures on the node. Set `"all-in-one"` for a single-host deployment, or `"indexer"` / `"dashboard"` when the Wazuh indexer and dashboard run on separate servers. | `"all-in-one"` |
+   | `WAZUH_INDEXER_IP` | IP address of the Wazuh indexer. Keep the default `127.0.0.1` when installing on the indexer node. | `"127.0.0.1"` |
+   | `WAZUH_INDEXER_PUBLIC_IP` | Reachable IP of the indexer host. Used to build the download links for generated PDF reports. | `"192.168.1.10"` |
+   | `WAZUH_INDEXER_USER` / `WAZUH_INDEXER_PASS` | Wazuh indexer credentials. | `"admin"` / `"<INDEXER_PASSWORD>"` |
+   | `WAZUH_MANAGER_IP` | IP address of the Wazuh manager. | `"127.0.0.1"` |
+   | `WAZUH_MANAGER_USER` / `WAZUH_MANAGER_PASS` | Wazuh server API credentials. | `"wazuh-wui"` / `"<MANAGER_PASSWORD>"` |
+   | `WAZUH_DASHBOARD_IP` | IP address of the Wazuh dashboard. | `"127.0.0.1"` |
+   | `WAZUH_DASHBOARD_USER` / `WAZUH_DASHBOARD_PASS` | Wazuh dashboard credentials. | `"admin"` / `"<DASHBOARD_PASSWORD>"` |
+   | `MCP_SERVER_PUBLIC_HOST` | IP address where the MCP server is reachable. | `"192.168.1.10"` |
+   | `MCP_SSE_URL` | URL of the MCP server SSE endpoint that the gateway connects to. | `"http://192.168.1.10:9900/sse"` |
+   | `GATEWAY_PUBLIC_HOST` | IP address where the ML commons connector reaches the MCP-LLM gateway. | `"192.168.1.10"` |
+   | `GATEWAY_API_KEY` | API key that authenticates requests to the gateway. Set a strong random value; the gateway does not start with the default value. | `"<STRONG_RANDOM_KEY>"` |
+   | `LLM_PROVIDER` | LLM backend used by the gateway: `"openai"`, `"gemini"`, or `"claude_bedrock"`. | `"openai"` |
+   | `OPENAI_API_KEY` | OpenAI API key. Required when `LLM_PROVIDER` is `"openai"`. | `"<YOUR_OPENAI_API_KEY>"` |
+   | `OPENAI_MODEL` | OpenAI model used by the gateway. | `"gpt-4o"` |
+   | `SMTP_HOST` / `SMTP_PORT` | SMTP server and port used to send the generated PDF reports via email. | `"smtp.gmail.com"` / `"587"` |
+   | `SMTP_USER` / `SMTP_PASS` | Sender email address and its password or app password. | `"<SENDER_EMAIL>"` / `"<APP_PASSWORD>"` |
+   | `SMTP_FROM` | From address shown on the report emails. | `"<SENDER_EMAIL>"` |
+
+   > **NOTE:** If you use Google Gemini or Amazon Bedrock instead of OpenAI, set `LLM_PROVIDER` to `"gemini"` or `"claude_bedrock"`, and configure `GEMINI_API_KEY` and `GEMINI_MODEL`, or `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `AWS_REGION`, and `BEDROCK_MODEL_ID`.
 
 3. **Run the installer script** as root:
    ```bash
@@ -137,16 +156,16 @@ The script will automatically perform:
 Use these to validate end-to-end behavior and the reporting format:
 
 **Threat Hunting:**
-- Show me the alerts summary of agent 002 for the last 30 min
+- Show me the alerts summary of agent 008 for the last 30 min
 - Give me a summary of the critical alerts from the last 30 min
 - Analyze the most important alerts in my environment
 - Analyze brute force attack alerts from last 1 hour
-![alt text](images/image-5.png)
+<img src="images/alert-summary.gif" alt="Threat Hunting demo" width="800">
 
 **DQL:**
 - Filter alerts from office365 that are from outside spain in last 2 hours
 - filter all the critical virustotal alerts from agent 002 in last three hours
-![alt text](images/image-4.png)
+<img src="images/DQL.gif" alt="DQL demo" width="800">
 
 **Agent Management:**
 *(Administrative actions generate a `Pending Action` block. You must reply directly with `CONFIRM` or `NO`)*
@@ -155,20 +174,20 @@ Use these to validate end-to-end behavior and the reporting format:
 - show agent groups
 - Remove all disconnected agent from last 10 minutes
 - add agent ID 001 to the agent group windows
-![alt text](images/image-6.png)
+<img src="images/agent-management.gif" alt="Agent Management demo" width="800">
 
 **Dashboard:**
 *(Dashboard creations generate a `Pending Action` block. You must reply directly with `CONFIRM` or `NO`)*
 - create custom dashboard
 - I need a dashboard for brute force attack alerts with geo location
 - create dashboard with a pie chart top 10 rule id triggered
-![alt text](images/image-3.png)
+<img src="images/dashboard-create.gif" alt="Dashboard creation demo" width="800">
 
 **IT Hygiene:**
 - What is the OS and OS version of agent 002
 - How many agents have edge software installed?
 - Can you check if the agent 001 has Valorant software installed?
-![alt text](images/image-2.png)
+<img src="images/IT-Hygiene.gif" alt="IT Hygiene demo" width="800">
 
 **SCA:**
 - Share the SCA score of agent 002
@@ -181,25 +200,17 @@ Use these to validate end-to-end behavior and the reporting format:
 - Make a summary of critical vulnerabilities.
 - How to resolve this vulnerability CVE-2015-0287?
 - Break down the critical vulnerability and affected packages for agent 001
-![alt text](images/image.png)
+<img src="images/vulnerability-check.gif" alt="Vulnerability check demo" width="800">
 
 **Generate PDF reports and send it via Email:**
-- send a email report for endpoints brute force attack alert via mail with detailed visualizations
-- send a email report for agents vulnerabilities via mail with detailed visualizations
-![alt text](images/image-7.png)
-
-![alt text](images/image-8.png)
-
-![alt text](images/image-9.png)
+- Send a email report for endpoints brute force attack alert via mail with detailed visualizations
+- Send a PDF report for active vulnerabilities on all endpoints via email.
+<img src="images/generate-report.gif" alt="Generate PDF report demo" width="800">
 
 **Create Wazuh indexer monitor:**
 
 - Send slack alert for authentication failed attempts from India
-![alt text](images/image-10.png)
-
-![alt text](images/image-11.png)
-
-![alt text](images/image-12.png)
+<img src="images/Indexer-monitor.gif" alt="Wazuh indexer monitor demo" width="800">
 
 ---