update

app.py

@@ -348,33 +348,18 @@ def enrich_ioc(ioc, ioc_type):
     if not bits:
         bits.append("No current threat-intelligence records for this indicator across ThreatFox, OTX, or VirusTotal.")
     label = {"ip": "IP Addresses", "domain": "Domains", "url": "URLs", "file": "File Hashes"}.get(ioc_type, "Indicators")
-    # grounded remediation derived from the ThreatFox threat type (avoids the model improvising one)
-    ttypes = " ".join((tf or {}).get("threat_types", [])).lower()
-    if not (tf or (vt and vt.get("malicious"))):
-        action = ""
-    elif any(k in ttypes for k in ("c&c", "command", "botnet")):
-        action = "Block and sinkhole this command-and-control indicator at the perimeter; hunt logs for hosts beaconing to it."
-    elif any(k in ttypes for k in ("payload", "distribution", "download")):
-        action = "Block this distribution host and scan endpoints for payloads retrieved from it."
-    else:
-        action = "Block the indicator at the perimeter and hunt for related connections across DNS, proxy, and firewall logs."
-    lines = [
-        "[Threat Report]",
-        f"Title: Live IOC enrichment — {ioc}",
-        "",
-        " ".join(bits),
-        "",
-        f"Reported indicators:\n  {label}: {ioc}",
-        f"Analyst-tagged ATT&CK: {', '.join(otx.get('attack', [])) or 'none tagged'}",
-        f"Malware families: {', '.join(families) or 'none named'}",
-        f"Attributed actor: {otx.get('adversary') or 'none specified'}",
-        f"Targeted industries: {', '.join(otx.get('industries', [])) or 'not specified'}",
-        f"Targeted countries: {', '.join(otx.get('countries', [])) or 'not specified'}",
-    ]
-    if action:
-        lines.append(f"Recommended action: {action}")
+    # Only live feed data goes in the report — no canned recommendation (the model writes the analysis).
     return ("Analyze this threat intelligence report. Produce a structured red-team summary using only "
-            "what the report states. Do not invent actors, malware, or indicators.\n\n" + "\n".join(lines))
+            "what the report states. Do not invent actors, malware, or indicators.\n\n"
+            "[Threat Report]\n"
+            f"Title: Live IOC enrichment — {ioc}\n\n"
+            f"{' '.join(bits)}\n\n"
+            f"Reported indicators:\n  {label}: {ioc}\n"
+            f"Analyst-tagged ATT&CK: {', '.join(otx.get('attack', [])) or 'none tagged'}\n"
+            f"Malware families: {', '.join(families) or 'none named'}\n"
+            f"Attributed actor: {otx.get('adversary') or 'none specified'}\n"
+            f"Targeted industries: {', '.join(otx.get('industries', [])) or 'not specified'}\n"
+            f"Targeted countries: {', '.join(otx.get('countries', [])) or 'not specified'}")
 
 
 def recent_threatfox_ioc():