PII Detection for Cybersecurity & Incident Response

import requests
from collections import Counter

API_URL = "https://piidetectionapi.com/api/moderate.php"
CHUNK = 40_000  # stay under the 50k char limit

def triage_dump(path: str) -> Counter:
    """Classify every chunk of a recovered file; return entity totals."""
    totals = Counter()
    text = open(path, encoding="utf-8", errors="replace").read()
    for i in range(0, len(text), CHUNK):
        resp = requests.post(API_URL, json={
            "api_key": "YOUR_API_KEY",
            "api_type": "pii_detection",
            "text": text[i:i + CHUNK],
            # no "entities" filter: scan for everything
            "mask_mode": "replace",
            "threshold": 0.5,
        }, timeout=30)
        for e in resp.json()["detected_entities"]:
            totals[e["type"]] += 1
    return totals

counts = triage_dump("leaked/customers_export.csv")

# Feed the notification analysis: statutory PII combos first
notify_triggers = ["SSN", "DRIVERS_LICENSE_NUMBER",
                   "FINANCIAL_ACCOUNT_NUMBER", "MEDICAL_DATA"]
rotate_now = ["PASSWORD", "API_KEY", "AWS_CREDENTIALS", "SSH_KEY"]

print("Notification-relevant:", {k: counts[k] for k in notify_triggers})
print("Rotate immediately:", {k: counts[k] for k in rotate_now})

// Node.js: detection step invoked by a SOAR playbook webhook
async function classifyArtifact(text) {
  const res = await fetch(
    "https://piidetectionapi.com/api/moderate.php",
    {
      method: "POST",
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({
        api_key: process.env.PII_API_KEY,
        api_type: "pii_detection",
        text,
        entities: ["SSN", "CREDIT_CARD_NUMBER",
                   "MEDICAL_DATA", "PASSWORD",
                   "AWS_CREDENTIALS", "SSH_KEY"],
        mask_mode: "replace",
        threshold: 0.6
      })
    }
  );
  return res.json();
}

app.post("/playbooks/dlp-alert", async (req, res) => {
  const data = await classifyArtifact(req.body.artifactText);

  const summary = {};
  data.detected_entities.forEach(e =>
    summary[e.type] = (summary[e.type] || 0) + 1);

  // Regulated identifiers or live secrets: escalate, never close
  const critical = ["SSN", "CREDIT_CARD_NUMBER",
                    "AWS_CREDENTIALS", "SSH_KEY"]
    .some(t => summary[t]);

  await soar.updateIncident(req.body.incidentId, {
    piiSummary: summary,                // counts only, no raw values
    sanitizedExcerpt: data.anonymized_text.slice(0, 500),
    severity: critical ? "critical" : "moderate"
  });
  res.sendStatus(204);
});