explain

Documentation

Overview

Package explain provides deterministic and AI-based explanations for CloudAttackPath instances discovered through graph traversal.

Deterministic explanations are generated offline from node ID prefixes. AI explanations are generated by calling Anthropic or OpenAI APIs when the relevant environment variables are set. dp runs fully offline when no AI key is configured.

Index

• func ExplainAttackPath(path models.CloudAttackPath) string
• func ExplainAttackPathAI(ctx context.Context, path models.CloudAttackPath) (string, error)
• func IsAIAvailable() (provider string, available bool)
• func PopulateExplanations(ctx context.Context, paths []models.CloudAttackPath, useAI bool) []models.CloudAttackPath

Functions

func ExplainAttackPath

func ExplainAttackPath(path models.CloudAttackPath) string

ExplainAttackPath generates a deterministic, human-readable explanation for a CloudAttackPath by examining each node ID in the path and emitting a sentence that describes the security implication of that node type.

The explanation is assembled from per-node sentences and joined with spaces. No network calls are made; the function is pure and offline.

func ExplainAttackPathAI

func ExplainAttackPathAI(ctx context.Context, path models.CloudAttackPath) (string, error)

ExplainAttackPathAI generates a human-readable AI explanation for the given CloudAttackPath. It prefers the Anthropic API (DP_ANTHROPIC_API_KEY) and falls back to OpenAI (DP_OPENAI_API_KEY) when the Anthropic key is absent. Returns an error when neither key is configured or when the API call fails.

func IsAIAvailable

func IsAIAvailable() (provider string, available bool)

IsAIAvailable reports whether an AI provider key is configured in the environment and returns the name of the preferred provider. Anthropic is preferred when both keys are set. Returns ("", false) when no key is present.

func PopulateExplanations

func PopulateExplanations(ctx context.Context, paths []models.CloudAttackPath, useAI bool) []models.CloudAttackPath

PopulateExplanations fills Explanation (deterministic) and, when useAI is true, AIExplanation (AI-generated) on each CloudAttackPath. AI failures are silently swallowed — a failed AI call leaves AIExplanation empty.