Skip to content

v1.0.0

Choose a tag to compare

View all tags
@rvong65 rvong65 released this 23 Jun 16:25
v1.0.0
49c2526

Summary

Initial tagged public release: retrieval-augmented threat intelligence chat over MITRE ATT&CK + CISA KEV, with mandatory citations, confidence scoring, hard abstention, and a live Streamlit demo.

The repository and app were public since 2026-06-12; pytest CI and README polish landed on 2026-06-18 before this tag.

Live demo: https://threat-intelligence-rag-assistant.streamlit.app/

Features

RAG pipeline

  • 3,312 indexed chunks — 697 techniques, 174 groups, 821 software, 1,614 KEV entries (MITRE ATT&CK Enterprise + CISA KEV)
  • Hybrid retrieval — FAISS similarity search + entity-ID docstore lookup (T####, G####, S####, CVE-####) + KEV/metadata boost
  • Grounded generation — LLM answers restricted to retrieved context only
  • Mandatory inline citations with post-LLM citation validation
  • Transparent confidence score (0–100) and hard abstention when evidence is weak
  • Query guard — blocks greetings and off-topic prompts before retrieval/LLM spend
  • Multi-turn conversational memory for short follow-ups

Streamlit app

  • Chat UI with example queries, sidebar sources, and confidence breakdown
  • “How it works” expander — pipeline, citations, cloud privacy notes
  • Groq-friendly error UX (rate limits / auth — no stack traces in chat)
  • Local-only admin ingest panel (validate datasets, rebuild FAISS index)

Deployment

  • Dual profile — local (Ollama) / cloud (Groq LLM + HuggingFace embeddings)
  • Pre-built FAISS index committed in repo — clone and run without Ollama or raw dataset downloads
  • Streamlit Community Cloud deploy (app.py + requirements.txt)

Quality & docs

  • 49 pytest tests + validation_matrix.py — 11 PASS · 1 WARN · 0 FAIL on Groq cloud profile
  • GitHub Actions CI — pytest on push/PR to main
  • requirements.txt / requirements-dev.txt split
  • README with architecture overview, data attribution, safety considerations, quick start

Quick start

git clone https://github.com/rvong65/threat-intelligence-assistant.git
cd threat-intelligence-assistant
python -m venv .venv
source .venv/bin/activate   # Windows: .\.venv\Scripts\activate
pip install -r requirements.txt
cp .env.example .env        # Windows: copy .env.example .env
# Set GROQ_API_KEY (cloud) or switch .env to Ollama block (local)
streamlit run app.py

Indexed corpus snapshot: see indices/faiss_index/manifest.json (built_at: 2026-06-10).
Raw MITRE/KEV files: see README → Data Sources.

Note

This release marks the MVP baseline. v1.1.0 adds Docker, docs/architecture.md, SVG assets, Docker CI, and Streamlit UI/branding polish.

Assets 2
Loading