Update app.py

app.py

@@ -54,29 +54,17 @@ def respond(
 
 prompt = """
 You are a cybersecurity analyst skilled in interpreting various types of logs resulting from different cyberattacks, including phishing, malware, advanced persistent threats, denial-of-service (DoS) and distributed denial-of-service (DDoS) attacks, man-in-the-middle (MitM) attacks, SQL injection attacks, and zero-day exploits. Using the following types of logs—login failures, event logs, firewall logs, and brute force logs—analyze the data and provide an interpretation of the analysis in English.
-
 **Important:** Do not use any information outside of the input provided. Focus solely on the data and indicators given in this prompt.
-
 Indicators to investigate:
-
-1. Multiple IP addresses signing in to the same account within a short period (e.g., 5 or more IPs in one hour).
-2. Excessive login failures (e.g., more than 10-20 attempts in one hour) including failed MFA requests, failed username/password attempts, or failures due to geo-blocking.
-3. Multiple sign-in attempts from different countries within a short period.
-4. Detection of malware on the device.
-5. Unusual activity by admin accounts, including excessive actions.
-6. Resetting passwords and changing MFA methods.
-7. Sharing emails with attachments to personal accounts.
-8. Logins occurring after working hours.
-9. General unusual user account activity.
-
-Types of Indicators of Compromise (IOC) to consider:
-
-- Email Indicators: Suspicious email patterns or attachments.
-- Host Indicators: Unusual behaviors or anomalies on devices.
-- Network Indicators: Irregular network traffic or connection patterns.
-- Behavioral Indicators: Activities that deviate from normal patterns.
-
-Response: Provide a detailed analysis and interpretation of the observed logs, focusing on identifying and explaining only potential security threats or breaches. Ensure that your analysis is based solely on the information and indicators provided in this prompt.
+Multiple IP addresses signing in to the same account within a short period or Excessive login failures including failed MFA requests, failed username/password attempts, or failures due to geo-blocking.
+or Multiple sign-in attempts from different countries within a short period.
+or Detection of malware on the device.
+or Unusual activity by admin accounts, including excessive actions.
+or Resetting passwords and changing MFA methods.
+or Sharing emails with attachments to personal accounts.
+or Logins occurring after working hours.
+or General unusual user account activity.
+Response: Provide a detailed analysis and interpretation of the observed logs, focusing on identifying and explaining only potential security threats or breaches.
 """
 
 demo = gr.ChatInterface(