v1.1.2

Summary

Patch release: Groq model migration and LLM resilience for the public Streamlit demo — moves the cloud default from deprecated Llama models to openai/gpt-oss-20b, auto-migrates legacy Groq IDs (8b → 20b, 70b → 120b), and adds retrieval-only fallback so users still get MITRE/KEV sources when the LLM is unavailable or misconfigured.

Live demo: https://threat-intelligence-rag-assistant.streamlit.app/

---

What's new

Groq migration (proactive)

• Cloud default LLM: openai/gpt-oss-20b (replaces llama-3.1-8b-instant; Groq shutdown 2026-08-16)
• Settings auto-migrate deprecated IDs:
  • llama-3.1-8b-instant → openai/gpt-oss-20b
  • llama-3.3-70b-versatile → openai/gpt-oss-120b
• Updated .env.example, docker-compose.yml, and README tech stack / validation baseline

Retrieval-only fallback (reactive)

• When LLM generation fails after retrieval, return formatted MITRE/KEV sources without synthesis (RETRIEVAL_ONLY_FALLBACK=true by default)
• Streamlit sidebar warning and toast for degraded retrieval-only mode
• Clearer Groq 404 / model unavailable error mapping

Testing and docs

• RAG integration tests — full chain.invoke path verifies answer, sidebar-equivalent sources, and confidence (CI: mocked LLM; optional live Groq when GROQ_API_KEY is set)
• README Resilience bullet under Safety; docs/architecture.md updated for degraded mode and v1.1.2

---

Quick start

Unchanged from v1.1.1 — see README Quick Start.

git clone https://github.com/rvong65/threat-intelligence-assistant.git
cd threat-intelligence-assistant
python -m venv .venv
source .venv/bin/activate   # Windows: .venv\Scripts\activate
pip install -r requirements.txt
cp .env.example .env        # Windows: copy .env.example .env
streamlit run app.py

Docker:

git clone https://github.com/rvong65/threat-intelligence-assistant.git
cd threat-intelligence-assistant
docker compose up --build
# open http://localhost:8501

---

Full changelog

See CHANGELOG.md#1.1.2

v1.1.1

Summary

Patch release: privacy and cloud data-handling disclosures for the public Groq-based Streamlit demo — clarifying where analyst questions and retrieved MITRE/KEV context are sent (Groq for generation, HuggingFace for query embeddings) and recommending synthetic or general threat-intel questions on the live app.

Live demo: https://threat-intelligence-rag-assistant.streamlit.app/

---

What's new

Privacy & data transparency

• README Privacy & data handling section under Safety (data flow table: LLM, embeddings, retrieved chunks, session memory)
• Short privacy callout at top of README and under Live Demo
• Streamlit sidebar Privacy & data expander (Groq + HuggingFace warning on cloud; Ollama/local note when self-hosted)
• docs/architecture.md — privacy cross-link in Security and safety section
• Guidance: no classified data, credentials, or live incident details on the public demo; use Ollama locally (or Docker with local profile) for sensitive environments

README polish

• Docker and RAG (Grounded Citations) badges at the top of the README (alongside Release, CI, License, Streamlit)

---

Quick start

Unchanged from v1.1.0 — see README Quick Start.

git clone https://github.com/rvong65/threat-intelligence-assistant.git
cd threat-intelligence-assistant
python -m venv .venv
source .venv/bin/activate   # Windows: .venv\Scripts\activate
pip install -r requirements.txt
copy .env.example .env
streamlit run app.py

Docker:

git clone https://github.com/rvong65/threat-intelligence-assistant.git
cd threat-intelligence-assistant
docker compose up --build
# open http://localhost:8501

---

Full changelog

See CHANGELOG.md#1.1.1

v1.1.0

Summary

Second public release: containerized runtime, full architecture documentation, SVG branding, and Streamlit UI polish — building on the v1.0.0 RAG MVP and live Streamlit demo.

Live demo: https://threat-intelligence-rag-assistant.streamlit.app/

---

What's new

Docker

• Dockerfile + docker-compose.yml — cloud-profile Streamlit on port 8501 (docker compose up --build)
• Optional --profile local for Ollama alongside the app
• .dockerignore for lean image builds
• CI docker job builds the image and checks Streamlit /_stcore/health on every push/PR

Documentation & design

• docs/architecture.md — goals, end-to-end diagram, module map, deployment topologies (local / Docker / Streamlit Cloud), architecture-level safety
• README refresh: collapsible TOC, version history, CI/CD table (pytest + Docker), repository layout, V2 roadmap table
• Theme-aware README logos (logo-light.svg / logo-dark.svg)
• CHANGELOG.md and GitHub Release discipline

App & branding

• Custom SVG mark in docs/assets/ (icon.svg, favicon.svg) — shield + minimal cyber-assistant bot
• Icon inline with Threat Intelligence Assistant title (main page + sidebar)
• Sidebar Runtime config card (profile, LLM, abstention, embeddings) with modern styling
• st.html() rendering for custom UI blocks (fixes raw HTML showing in sidebar)

CI / dependencies

• GitHub Actions: pytest (49 tests) + Docker health check
• requirements-dev.txt for local/CI test deps; requirements.txt stays lean for Streamlit Cloud

Artifacts

• Committed: indices/faiss_index/ (pre-built FAISS index — no raw MITRE/KEV download required to run)
• Raw datasets gitignored (data/raw/, data/processed/) — rebuild via scripts/ingest.py --build-index

---

Quick start

git clone https://github.com/rvong65/threat-intelligence-assistant.git
cd threat-intelligence-assistant
python -m venv .venv
source .venv/bin/activate   # Windows: .\.venv\Scripts\activate
pip install -r requirements.txt
cp .env.example .env        # Windows: copy .env.example .env
# Set GROQ_API_KEY for cloud profile (or use Streamlit Secrets when deploying)
streamlit run app.py

Docker:

git clone https://github.com/rvong65/threat-intelligence-assistant.git
cd threat-intelligence-assistant
docker compose up --build
# open http://localhost:8501
# optional: GROQ_API_KEY=... docker compose up --build

Tests:

pip install -r requirements-dev.txt
pytest tests/ -q

---

Full changelog

See CHANGELOG.md#1.1.0

v1.0.0

Summary

Initial tagged public release: retrieval-augmented threat intelligence chat over MITRE ATT&CK + CISA KEV, with mandatory citations, confidence scoring, hard abstention, and a live Streamlit demo.

The repository and app were public since 2026-06-12; pytest CI and README polish landed on 2026-06-18 before this tag.

Live demo: https://threat-intelligence-rag-assistant.streamlit.app/

---

Features

RAG pipeline

• 3,312 indexed chunks — 697 techniques, 174 groups, 821 software, 1,614 KEV entries (MITRE ATT&CK Enterprise + CISA KEV)
• Hybrid retrieval — FAISS similarity search + entity-ID docstore lookup (T####, G####, S####, CVE-####) + KEV/metadata boost
• Grounded generation — LLM answers restricted to retrieved context only
• Mandatory inline citations with post-LLM citation validation
• Transparent confidence score (0–100) and hard abstention when evidence is weak
• Query guard — blocks greetings and off-topic prompts before retrieval/LLM spend
• Multi-turn conversational memory for short follow-ups

Streamlit app

• Chat UI with example queries, sidebar sources, and confidence breakdown
• “How it works” expander — pipeline, citations, cloud privacy notes
• Groq-friendly error UX (rate limits / auth — no stack traces in chat)
• Local-only admin ingest panel (validate datasets, rebuild FAISS index)

Deployment

• Dual profile — local (Ollama) / cloud (Groq LLM + HuggingFace embeddings)
• Pre-built FAISS index committed in repo — clone and run without Ollama or raw dataset downloads
• Streamlit Community Cloud deploy (app.py + requirements.txt)

Quality & docs

• 49 pytest tests + validation_matrix.py — 11 PASS · 1 WARN · 0 FAIL on Groq cloud profile
• GitHub Actions CI — pytest on push/PR to main
• requirements.txt / requirements-dev.txt split
• README with architecture overview, data attribution, safety considerations, quick start

---

Quick start

git clone https://github.com/rvong65/threat-intelligence-assistant.git
cd threat-intelligence-assistant
python -m venv .venv
source .venv/bin/activate   # Windows: .\.venv\Scripts\activate
pip install -r requirements.txt
cp .env.example .env        # Windows: copy .env.example .env
# Set GROQ_API_KEY (cloud) or switch .env to Ollama block (local)
streamlit run app.py

Indexed corpus snapshot: see indices/faiss_index/manifest.json (built_at: 2026-06-10).
Raw MITRE/KEV files: see README → Data Sources.

---

Note

This release marks the MVP baseline. v1.1.0 adds Docker, docs/architecture.md, SVG assets, Docker CI, and Streamlit UI/branding polish.