Update app.py

app.py

@@ -17,6 +17,13 @@ techniques = mitre_attack_data.get_techniques(remove_revoked_deprecated=True)
 # Convert techniques to a readable string format
 techniques_str = "\n".join([f"{technique['name']} ({mitre_attack_data.get_attack_id(technique['id'])})" for technique in techniques])
 
+def clean_string(input_string):
+
+    characters_to_remove = [',', '/', ':', '"',';','|','-','_']
+    cleaned_string = ''.join(char for char in input_string if char not in characters_to_remove)
+    
+    return cleaned_string
+
 client = InferenceClient(model='mistralai/Mixtral-8x7B-Instruct-v0.1')
 
 
@@ -58,8 +65,16 @@ demo = gr.ChatInterface(
     respond,
     additional_inputs=[
         # gr.Textbox(value=f"""<s>[INST] Given these TTPs: {techniques_str}\n\n and here are {descriptions}\n\nfigure out which major techniques are used in these logs and respond in bullets points and nothing else[/INST]""", label="System message"),
-        gr.Textbox(value=f"""<s>[INST] Given these TTPs: {techniques_str}\n\nfigure out which major techniques are used in these logs and respond in bullets points and nothing else[/INST]""", label="System message"),
-        gr.Slider(minimum=1, maximum=2048, value=1024, step=1, label="Max new tokens"),
+        # gr.Textbox(value=f"""<s>[INST] Given these TTPs: {techniques_str}\n\nfigure out which major techniques are used in these logs and respond in bullets points and nothing else[/INST]""", label="System message"),
+        gr.Textbox(value=f"""<s>[INST] In first step Given these TTPs: {techniques_str}\n\nfigure out which major techniques are used in these logs and respond in bullets points and nothing else\n\n 
+        In second step next act like a cybersecurity analyst skilled in interpreting various types of logs resulting from different cyberattacks, including phishing, malware, advanced persistent threats, denial-of-service (DoS) and distributed denial-of-service (DDoS) attacks, man-in-the-middle (MitM) attacks, SQL injection attacks, and zero-day exploits. Using the following types of logs—login failures, event logs, firewall logs, and brute force logs—analyze the data and provide an interpretation of the analysis in English.
+        **Important:** Do not use any information outside of the input provided. Focus solely on the data and indicators given in this prompt.
+        Indicators to investigate: Multiple IP addresses signing in to the same account within a short period or Excessive login failures including failed MFA requests, failed username/password attempts, or failures due to geo-blocking
+        or Multiple sign-in attempts from different countries within a short period or Detection of malware on the device or Unusual activity by admin accounts, including excessive actions or Resetting passwords and changing MFA methods
+        or Sharing emails with attachments to personal accounts or Logins occurring after working hours or General unusual user account activity.
+        Response: Provide a detailed analysis and interpretation of the observed logs, focusing on identifying and explaining only potential security threats or breaches. Ensure that your analysis is based solely on the information and indicators provided in this prompt.
+        [/INST]""", label="System message"),
+        gr.Slider(minimum=1, maximum=2048, value=512, step=1, label="Max new tokens"),
         gr.Slider(minimum=0.1, maximum=1.0, value=0.1, step=0.1, label="Temperature"),
         gr.Slider(minimum=0.1, maximum=1.0, value=0.95, step=0.05, label="Top-p (nucleus sampling)"),
     ],