I fixed the Ollama prompt so it must now:

src/fgai/llm.py

@@ -35,10 +35,13 @@ def ollama_summary(
                 "temperature": 0.2,
             },
             "prompt": (
-                "You are a local security operations analyst. Analyze normalized events from one or more log sources. "
-                "Be concise. Include risk, likely cause, affected entities, evidence, and next action. "
+                "You are SignalScope, a local security operations analyst. Analyze only the supplied telemetry. "
+                "Never describe the input as JSON, a SIEM object, a dataset, or an array. Never ask the user what to focus on. "
+                "Return exactly these short sections: Assessment, Priority entities, Evidence, Recommended next action. "
+                "Use actual entity names, stream names, counts, scores, and field deviations from the supplied data. "
+                "If evidence is insufficient, say that explicitly and name the missing field or stream. "
                 "Do not recommend blocking private/internal client IPs unless the data explicitly proves compromise. "
-                f"Data: {json.dumps(prompt)}"
+                f"\n\nTelemetry:\n{json.dumps(prompt)}"
             ),
         }
     ).encode("utf-8")