Summary
Patch release: privacy and data-handling disclosures for the public Streamlit demo — clarifying that this app does not call third-party APIs (no LLMs, cloud ML, or analytics), how uploads are handled in-session, and when to use local or Docker instead of Streamlit Cloud for sensitive EDR logs.
Live demo: https://mitre-attack-chain-visualizer.streamlit.app/
What's new
Privacy & data transparency
- README Privacy & data handling section under Safety (data flow table: built-in demo CSVs, local/Docker uploads, Streamlit Cloud uploads, CSV/STIX exports)
- Privacy bullet under Live Demo (below Cold start), linking to the Safety section and Docker quick start
- Streamlit sidebar How It Works — privacy paragraph (no third-party APIs; cloud hosting note; local/Docker for sensitive telemetry)
- docs/architecture.md — Privacy & data handling under Security & safety
- Guidance: no production or classified telemetry on the public demo unless your organization permits it; use local or Docker for sensitive environments
README polish
- Analysis — Chain storylines (core feature) and Deploy — Docker | local badges at the top of the README (alongside Release, CI, License, Streamlit)
Quick start
Unchanged from v1.1.0 — see README Quick Start.
git clone https://github.com/rvong65/mitre-attack-chain-visualizer.git
cd mitre-attack-chain-visualizer
python -m venv .venv
source .venv/bin/activate # Windows: .venv\Scripts\activate
pip install -r requirements.txt
streamlit run app.py
# Built-in polished chains load automatically — no raw logs requiredDocker:
git clone https://github.com/rvong65/mitre-attack-chain-visualizer.git
cd mitre-attack-chain-visualizer
docker compose up --build
# open http://localhost:8501