Threat Detection

{
  "model": "threat-classifier-v2",
  "confidence_threshold": 0.8,
  "categories": [
    "prompt_injection",
    "jailbreak_attempt",
    "data_exfiltration",
    "social_engineering",
    "abuse_attempt"
  ]
}

{
  "model": "safety-classifier-v3",
  "confidence_threshold": 0.75,
  "categories": [
    "toxicity",
    "harassment",
    "hate_speech",
    "self_harm",
    "violence"
  ]
}

{
  "model": "pii-detector-v4",
  "confidence_threshold": 0.9,
  "entity_types": [
    "person",
    "phone_number",
    "email",
    "ssn",
    "credit_card",
    "api_key"
  ]
}

// Example threat patterns
const threatPatterns = {
  promptInjection: [
    /ignore\s+(all\s+)?(previous|above|prior)\s+(instructions?|prompts?)/i,
    /forget\s+(everything|all)\s+(you\s+)?(know|learned)/i,
    /you\s+are\s+now\s+(a\s+)?different/i
  ],

  dataExfiltration: [
    /(show|tell|give)\s+me\s+your\s+(system|initial)\s+(prompt|instructions?)/i,
    /what\s+(are|were)\s+your\s+(original\s+)?(instructions?|guidelines?)/i,
    /repeat\s+your\s+(system\s+)?(message|prompt)/i
  ],

  jailbreak: [
    /pretend\s+to\s+be\s+(a\s+)?(different|evil|harmful)/i,
    /act\s+as\s+if\s+you\s+(have\s+no|don't\s+have)\s+(restrictions?|limitations?)/i,
    /for\s+educational\s+purposes\s+only/i
  ]
};

{
  "detection_config": {
    "prompt_injection": {
      "threshold": 0.8,
      "action": "block",
      "sensitivity": "balanced"
    },
    "data_exfiltration": {
      "threshold": 0.9,
      "action": "block",
      "sensitivity": "strict"
    },
    "pii_detection": {
      "threshold": 0.95,
      "action": "redact",
      "sensitivity": "strict"
    },
    "toxicity": {
      "threshold": 0.7,
      "action": "log",
      "sensitivity": "permissive"
    }
  }
}

# Create custom detection rule
curl https://api.promptguard.co/v1/detection/rules \
  -H "X-API-Key: YOUR_PROMPTGUARD_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Company-Specific Injection",
    "pattern": "(company|internal|confidential).*(bypass|override|ignore)",
    "threat_type": "prompt_injection",
    "severity": "high",
    "action": "block"
  }'

{
  "language_support": {
    "enabled_languages": ["en", "es", "fr", "de", "zh", "ja"],
    "auto_detect": true,
    "fallback_language": "en",
    "translation_threshold": 0.8
  }
}

{
  "action_config": {
    "prompt_injection": {
      "low": "log",
      "medium": "redact",
      "high": "block",
      "critical": "block_and_alert"
    },
    "data_exfiltration": {
      "any": "block_and_alert"
    },
    "pii_detection": {
      "any": "redact"
    }
  }
}

{
  "redaction_config": {
    "email": {
      "strategy": "mask",
      "replacement": "[EMAIL]",
      "preserve_domain": false
    },
    "phone": {
      "strategy": "partial_mask",
      "replacement": "XXX-XXX-{last_4}",
      "preserve_area_code": true
    },
    "ssn": {
      "strategy": "full_mask",
      "replacement": "[SSN]"
    },
    "api_key": {
      "strategy": "remove",
      "replacement": ""
    }
  }
}

{
  "model_performance": {
    "threat_classifier": {
      "precision": 0.94,
      "recall": 0.89,
      "f1_score": 0.91,
      "false_positive_rate": 0.02
    },
    "pii_detector": {
      "precision": 0.98,
      "recall": 0.95,
      "f1_score": 0.96,
      "false_positive_rate": 0.01
    }
  }
}

# Get threat detection report
curl https://api.promptguard.co/v1/detection/reports \
  -H "X-API-Key: YOUR_PROMPTGUARD_API_KEY" \
  -G -d "timeframe=7d" \
  -d "threat_types=prompt_injection,data_exfiltration"

{
  "context_analysis": {
    "conversation_history": true,
    "user_behavior_patterns": true,
    "session_anomaly_detection": true,
    "cross_request_correlation": true
  }
}

{
  "adaptive_learning": {
    "enabled": true,
    "feedback_learning": true,
    "domain_adaptation": true,
    "custom_model_training": false
  }
}

{
  "threat_intelligence": {
    "external_feeds": ["cyber_threat_intel", "security_vendors"],
    "internal_patterns": true,
    "community_sharing": false,
    "real_time_updates": true
  }
}

// JavaScript example with real-time alerts
const threatMonitor = {
  onThreatDetected: (event) => {
    console.log('Threat detected:', event);

    if (event.severity === 'critical') {
      // Send immediate alert
      alertSecurityTeam(event);
    }

    // Log to security system
    logSecurityEvent(event);
  },

  onFalsePositive: (event) => {
    // Provide feedback to improve detection
    provideFeedback(event.id, 'false_positive');
  }
};

# Python example with custom response logic
def handle_threat_detection(threat_event):
    threat_type = threat_event['type']
    severity = threat_event['severity']

    if threat_type == 'prompt_injection':
        if severity == 'high':
            # Block and log
            return {'action': 'block', 'log': True}
        else:
            # Redact suspicious parts
            return {'action': 'redact', 'patterns': threat_event['patterns']}

    elif threat_type == 'data_exfiltration':
        # Always block data exfiltration attempts
        return {'action': 'block', 'alert': True}

    else:
        # Default to logging
        return {'action': 'log'}