The Open Interface to Autonomous Security

Request

{
  "model": "sara",
  "messages": [
    {"role": "user", "content": "What is CVE-2024-3400?"}
  ]
}

Response

{
  "id": "chatcmpl-abc123",
  "object": "chat.completion",
  "created": 1711000000,
  "model": "sara",
  "choices": [{
    "index": 0,
    "message": {"role": "assistant", "content": "..."},
    "finish_reason": "stop"
  }],
  "usage": {"prompt_tokens": 150, "completion_tokens": 200, "total_tokens": 350}
}

Python (OpenAI SDK)

from openai import OpenAI

client = OpenAI(
    base_url="https://sara-open.sirp.io/api/v1",
    api_key="sara_your_key_here",
)

resp = client.chat.completions.create(
    model="sara",
    messages=[{"role": "user", "content": "Analyze IP 185.220.101.34"}],
)
print(resp.choices[0].message.content)

LangChain

from langchain_openai import ChatOpenAI

llm = ChatOpenAI(
    base_url="https://sara-open.sirp.io/api/v1",
    api_key="sara_your_key_here",
    model="sara",
)
print(llm.invoke("What is APT29?").content)

Request — single turn

{
  "message": "What is CVE-2024-3400?",
  "web_browse": true
}

Request — multi-turn

{
  "messages": [
    {"role": "user", "content": "Tell me about APT28"},
    {"role": "assistant", "content": "APT28 is..."},
    {"role": "user", "content": "What TTPs do they use?"}
  ]
}

Response

{
  "response": "CVE-2024-3400 is a critical vulnerability in PAN-OS...",
  "mode": "threat_intel",
  "sources": ["Knowledge Base", "NVD"],
  "iocs_detected": [],
  "trace_id": "trc_8f3a...",
  "remaining_this_hour": 499,
  "hourly_limit": 500
}

Request

{
  "iocs": [
    {"value": "185.220.101.34", "type": "ip"},
    {"value": "44d88612fea8a8f36de82e1278abb02f", "type": "hash"}
  ]
}

Max 20 IOCs per request. Types: ip, hash, domain, url.

Response

{
  "results": "### 185.220.101.34\n**Verdict:** SUSPICIOUS...",
  "ioc_count": 2,
  "verdicts": [
    {"value": "185.220.101.34", "type": "ip", "verdict": "SUSPICIOUS", "score": 60},
    {"value": "44d886...", "type": "hash", "verdict": "MALICIOUS", "score": 90}
  ]
}

Verdict floors: KEV / abuse.ch confirmed-malicious feeds set a deterministic MALICIOUS floor that an LLM cannot override (see sara/core/observation_decoder.py).

Request

// Alert triage
{"content": "EventID=4625 LogonType=3 TargetUserName=admin...", "type": "alert"}

// Phishing email
{"content": "From: [email protected]\nReply-To: [email protected]...", "type": "email"}

// CVE lookup
{"content": "CVE-2024-3400", "type": "cve"}

// Auto-detect
{"content": "CEF:0|Palo Alto|Cortex XDR|...", "type": "auto"}

Types: alert (CEF, syslog, Kibana, JSON, Windows Event Log), email (phishing), cve, auto.

Response

{
  "analysis": "## Facts\n- Observed: EventID 4625...",
  "type": "windows_event"
}

{"name": "My SOAR Integration"}

The full key is returned once in the response — save it immediately. After this call the prefix is the only thing the API ever returns.

{"ioc": "185.220.101.34"}

Also supports GET /api/free-tools/ioc-check?ioc=… for embed-friendly use.

{"description": "Detect PowerShell with encoded command"}

{"raw_email": "From: …\nSubject: …\n\n…"}

Runs 25+ checks (SPF / DKIM / DMARC, signing-domain mismatch, RFC 2047 encoding, invisible Unicode, Base64 URL decoding) and auto-generates a matching Sigma rule.

{"input": { /* agent-shape varies */ },
 "incident_id": "266279"}

{
  "message_id": "msg_abc123",
  "feedback": "up",            // "up" | "down"
  "comment": "Citation was spot-on",  // optional, max 2000 chars
  "mode": "threat_intel",
  "agent": ""
}