···11111212This repository is home to one of ROOST’s safety tools, the Osprey rules engine. Osprey is an open-source event stream decisions engine and analysis UI designed to investigate and take automatic action on events and their properties as they happen in real-time. Originally developed internally at [Discord](https://discord.com/) to combat spam, abuse, botting, and scripting across its platform, Osprey has now been open-sourced to help other platforms facing similar challenges.
13131414-Osprey is a library for processing actions through human written rules and outputting labels, webhooks back to an API and other sinks. It evaluates events using structured logic (SML), user-defined functions (UDFs), and external signals to assign labels, verdicts, and actions.
1414+Osprey is a library for processing actions through human-written rules and outputting verdicts & custom effects back to configurable output sinks. It evaluates events using structured rule logic (SML) that is extendable via user-defined functions (UDFs). Osprey can also track state across events by labelling entities if implementers provide a labels service backend (see [labels_service.py](./example_plugins/src/labels_service.py) for a Postgres-backed labels service example)
15151616This 'Rules \+ Investigation' tool is able to:
1717···8383 ```bash
8484 # Test linting
8585 uv run ruff check
8686+ uv run mypy .
86878788 # Test formatting
8889 uv run ruff format --diff
···9192 uv run pre-commit run --all-files
929393945. **Start Services:**
9595+9496 ```bash
9597 docker compose up -d
9698 ```
9999+100100+6. (Optional) **Port Forward the UI/UI API:**
101101+102102+ If you are running the docker compose on a headless machine, you will need to port forward the UI and UI API.
103103+ Namely, ports `5002` (UI) and `5004` (UI API). Then, you can connect via http://localhost:5002/ :D
971049810599106### Development Workflow
+9-10
docs/DEVELOPMENT.md
···113113docker compose up -d
114114```
115115116116-This starts up four services:
117117-- **Kafka** (KRaft mode): Message streaming for user generated events
116116+This starts up many services, including:
118117- **Osprey Worker**: The main engine that processes input events given the rules and UDFs
119119-- **Test Data Producer**: Optional with `--profile test_data`
118118+ - **Test Data Producer**: Optional with `--profile test_data`
119119+- **Osprey UI**: Frontend service that hosts the react code for the web interface and communicates to the UI API
120120- **Osprey UI API**: Backend service that provides data and functionality to the web interface
121121+- **Kafka** (KRaft mode): Message streaming for user generated events
122122+- **Postgres**: A database that the Worker, UI API, and Druid use for various reasons, such as the Postgres-backed Labels Service (in the example plugins)
123123+- **Druid**: A database that consumes Osprey Worker outputs to power the UI API for real-time querying
121124122122-### 6. Start the UI (in a new terminal):
123123-``` bash
124124-cd osprey_ui
125125- npm install
126126- npm start
127127-```
128125129129-### 7. Access the Application
126126+### 6. Access the Application
130127The UI will automatically connect to the backend services running in Docker containers.
131128132129 - Osprey UI: http://localhost:5002
···202199203200# Type checking (on specific files/modules)
204201uv run mypy osprey_worker/src/osprey_worker/lib
202202+# Or you can type check every module (this will happen in CI)
203203+uv run mypy .
205204206205# Run all pre-commit hooks
207206uv run pre-commit run --all-files