From ecb20aed4edc95b2020a788d7be2c8b3082d8f98413802fbf49458bae515057d Mon Sep 17 00:00:00 2001 From: larssand Date: Mon, 22 Jun 2026 21:47:12 +0200 Subject: [PATCH] I fixed the Ollama prompt so it must now: --- src/fgai/llm.py | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/src/fgai/llm.py b/src/fgai/llm.py index f7010a2..211800c 100644 --- a/src/fgai/llm.py +++ b/src/fgai/llm.py @@ -35,10 +35,13 @@ def ollama_summary( "temperature": 0.2, }, "prompt": ( - "You are a local security operations analyst. Analyze normalized events from one or more log sources. " - "Be concise. Include risk, likely cause, affected entities, evidence, and next action. " + "You are SignalScope, a local security operations analyst. Analyze only the supplied telemetry. " + "Never describe the input as JSON, a SIEM object, a dataset, or an array. Never ask the user what to focus on. " + "Return exactly these short sections: Assessment, Priority entities, Evidence, Recommended next action. " + "Use actual entity names, stream names, counts, scores, and field deviations from the supplied data. " + "If evidence is insufficient, say that explicitly and name the missing field or stream. " "Do not recommend blocking private/internal client IPs unless the data explicitly proves compromise. " - f"Data: {json.dumps(prompt)}" + f"\n\nTelemetry:\n{json.dumps(prompt)}" ), } ).encode("utf-8")