update

app.py

@@ -361,6 +361,23 @@ def enrich_ioc(ioc, ioc_type):
             f"Targeted countries: {', '.join(otx.get('countries', [])) or 'not specified'}")
 
 
+def recent_threatfox_ioc():
+    """A random *current* abuse.ch ThreatFox IP indicator, so the demo chip hits live data."""
+    key = _env(*ABUSE_KEYS)
+    if not key:
+        return None
+    body = json.dumps({"query": "get_iocs", "days": 1}).encode()
+    req = urllib.request.Request("https://threatfox-api.abuse.ch/api/v1/", data=body,
+        headers={"Auth-Key": key, "Content-Type": "application/json", "User-Agent": "TextScout-demo"})
+    d = json.loads(urllib.request.urlopen(req, timeout=15).read())
+    rows = d.get("data") if d.get("query_status") == "ok" else None
+    if not isinstance(rows, list) or not rows:
+        return None
+    import random
+    pool = [r for r in rows if r.get("ioc_type") == "ip:port"] or rows
+    return random.choice(pool).get("ioc", "").split(":")[0]
+
+
 # --- bundled retrieval -----------------------------------------------------------
 IOC_RE = re.compile(r"hxxp|https?://|\b\d{1,3}\[?\.\]?\d{1,3}\[?\.\]?\d{1,3}\[?\.\]?\d{1,3}\b|\b[a-f0-9]{32,64}\b", re.I)
 ACTOR_KW = re.compile(r"\b(actor|group|apt|adversary|profile|who is|what did|techniques does|ttps|campaign)\b", re.I)
@@ -481,8 +498,7 @@ SUGGESTIONS = {
     "🛠️ Who uses Cobalt Strike?": "Which threat actors use the Cobalt Strike tool?",
     "📖 Explain technique T1059.001": "Explain MITRE ATT&CK technique T1059.001",
     "🔓 Assess CVE-2025-0282 (live)": "Assess CVE-2025-0282 for offensive relevance",
-    "🌐 Look up a live IOC": ("Look up live threat intelligence for the indicator "
-                              "27.204.192.167 and assess its red team relevance."),
+    "🌐 Look up a fresh live IOC": None,   # None -> pull a current abuse.ch IOC at click time
 }
 
 if "messages" not in st.session_state:
@@ -490,11 +506,17 @@ if "messages" not in st.session_state:
 
 clicked = None
 if not st.session_state.messages:
-    st.markdown("##### Try one of these 👇")
+    st.markdown("##### Try one of these 👇  ·  or type your own actor / CVE / IP / hash below")
     cols = st.columns(2)
     for i, (label, text) in enumerate(SUGGESTIONS.items()):
         if cols[i % 2].button(label, use_container_width=True):
-            clicked = text
+            if text is None:                       # live IOC chip: grab a current indicator
+                ioc = _safe(recent_threatfox_ioc)
+                clicked = (f"Look up live threat intelligence for the indicator {ioc} "
+                           "and assess its red team relevance." if ioc else
+                           "Look up live threat intelligence for the indicator 1.1.1.1.")
+            else:
+                clicked = text
 
 for msg in st.session_state.messages:
     with st.chat_message(msg["role"], avatar=ROBOT if msg["role"] == "assistant" else None):