From 2e6c21226a82265dd6436cd7a8ceab8b3d83ffee Mon Sep 17 00:00:00 2001 From: kaushik-kumaran Date: Fri, 17 Apr 2026 12:05:40 -0700 Subject: [PATCH] feat: structured AI assessment with what happened / blast radius / action sections --- agent/src/reasoning.py | 11 ++++++++ ui/src/pages/ThreatFeed.tsx | 52 ++++++++++++++++++++++++------------- 2 files changed, 45 insertions(+), 18 deletions(-) diff --git a/agent/src/reasoning.py b/agent/src/reasoning.py index 23569ad..d425d75 100644 --- a/agent/src/reasoning.py +++ b/agent/src/reasoning.py @@ -54,6 +54,17 @@ **Blast radius assessment:** Consider: What namespace? What does this pod do? What secrets/volumes does it have? What can it reach via network? What services depend on it? +## Writing style +Write your assessment like you're briefing a smart but non-technical manager who needs to make a quick decision. Use plain English. No jargon. No acronyms without explanation. + +Bad: "The process memfd:runc executed with EXE_FROM_MEMFD flags indicating fileless execution via T1620." +Good: "A hidden process ran in memory on the server — this technique is used by attackers to hide malicious code from antivirus tools." + +Bad: "Lateral movement via credential access in the prod namespace presents elevated blast radius." +Good: "If this is real, the attacker could access your payment system and steal customer data." + +Keep it to 2-3 sentences maximum. Start with what happened, then say whether it looks dangerous or not, then say what should happen next. + ## Context you will receive - The Falco alert: rule, priority, process, file, command line - Pod context: image, age, restart count, owner, resource limits, namespace labels diff --git a/ui/src/pages/ThreatFeed.tsx b/ui/src/pages/ThreatFeed.tsx index 35b547a..80db509 100644 --- a/ui/src/pages/ThreatFeed.tsx +++ b/ui/src/pages/ThreatFeed.tsx @@ -187,34 +187,50 @@ export default function ThreatFeed() {
-
AI Assessment
+
AI Assessment
-
+
- ARGUS AI · claude-sonnet-4-6 + ARGUS AI · claude-sonnet-4-6
- {Math.round(selected.confidence * 100)}% confidence + {Math.round(selected.confidence * 100)}% confidence
-
-
-

{selected.assessment}

-
+
+
+
+ 01 + What happened +
+

{selected.assessment}

+
-
-
-
False positive
-
{selected.likely_false_positive ? 'Yes' : 'No'}
+
+
+ 02 + Blast radius +
+

{selected.blast_radius}

-
-
Confidence
-
{Math.round(selected.confidence * 100)}%
+ +
+
+ 03 + Recommended action +
+

{selected.recommended_action}

-
-
Blast radius
-

{selected.blast_radius}

+
+
+
False positive
+
{selected.likely_false_positive ? 'Yes' : 'No'}
+
+
+
Confidence
+
{Math.round(selected.confidence * 100)}%
+