update

app.py

@@ -362,6 +362,29 @@ def enrich_ioc(ioc, ioc_type):
             f"Targeted countries: {', '.join(otx.get('countries', [])) or 'not specified'}")
 
 
+def ioc_summary(ioc, ioc_type):
+    """One-line live-intel summary from the feeds — DISPLAY ONLY, not fed to the model."""
+    tf = _safe(_threatfox, ioc)
+    otx = _safe(_otx, ioc, ioc_type)
+    vt = _safe(_vt, ioc, ioc_type)
+    parts = []
+    fams = sorted(set((tf or {}).get("families", []) + (otx or {}).get("families", [])))
+    if fams:
+        parts.append("🦠 " + ", ".join(fams[:3]))
+    if tf and tf.get("threat_types"):
+        tt = tf["threat_types"][0].lower()
+        parts.append("C&C server" if any(k in tt for k in ("c&c", "command", "botnet"))
+                     else "payload host" if any(k in tt for k in ("payload", "distribution"))
+                     else tf["threat_types"][0])
+    if tf and tf.get("confidence"):
+        parts.append(f"ThreatFox {tf['confidence']}%")
+    if vt and vt.get("total"):
+        parts.append(f"VT {vt['malicious']}/{vt['total']}")
+    if otx and otx.get("pulse_count"):
+        parts.append(f"OTX {otx['pulse_count']} pulses")
+    return " · ".join(parts) if parts else None
+
+
 def recent_threatfox_ioc():
     """A random *current* abuse.ch ThreatFox IP indicator, so the demo chip hits live data."""
     key = _env(*ABUSE_KEYS)
@@ -521,6 +544,8 @@ if not st.session_state.messages:
 
 for msg in st.session_state.messages:
     with st.chat_message(msg["role"], avatar=ROBOT if msg["role"] == "assistant" else None):
+        if msg.get("summary"):
+            st.info(msg["summary"])          # live-intel card, straight from the feeds
         if msg.get("retrieved"):
             with st.expander(f"🔎 RAG — record retrieved from {msg.get('source', 'source')}"):
                 st.code(msg["retrieved"])
@@ -535,12 +560,16 @@ if user_input:
     with st.chat_message("assistant", avatar=ROBOT):
         with st.spinner("🔎 Retrieving + analyzing…"):
             prompt, retrieved, source, note = route(user_input)
+            summary = None
             if note:
                 answer, badge = note, None
             else:
+                if source and source.startswith("live ThreatFox"):
+                    dioc, dtype = detect_ioc(user_input)
+                    summary = _safe(ioc_summary, dioc, dtype) if dioc else None
                 answer = generate(prompt, max_new_tokens=max_tokens)
                 badge = ("🛡️ No record retrieved → refused (honesty guardrail)"
                          if REFUSAL_HINTS.search(answer) else "✅ Grounded in the retrieved record")
-    st.session_state.messages.append({"role": "assistant", "content": answer,
-                                      "retrieved": retrieved, "source": source, "badge": badge})
+    st.session_state.messages.append({"role": "assistant", "content": answer, "retrieved": retrieved,
+                                      "source": source, "badge": badge, "summary": summary})
     st.rerun()