🛡️ SIB Alert Analysis {% if cached %}📋 Cached{% endif %}
{% if error %}
Analysis Error: {{ error }}
{% else %}
🔐 Privacy Protected: Sensitive data was obfuscated before AI analysis.
IPs, usernames, hostnames, and secrets are replaced with tokens.
{% if cached %}
This is a cached result from {{ timestamp }}.{% endif %}
Original Alert
{{ original_output }}
{% if obfuscated_output and obfuscated_output != original_output %}
🔒 What Was Sent to AI (Obfuscated)
{{ obfuscated_output }}
{% endif %}
{% if obfuscation_mapping and show_mapping %}
Obfuscation Mapping
{% for category, mappings in obfuscation_mapping.items() %}
{% if mappings and category != 'secrets_count' %}
{{ category }}: {{ mappings }}
{% endif %}
{% endfor %}
{% endif %}
Attack Vector
{{ analysis.attack_vector or 'N/A' }}
MITRE ATT&CK
{% if analysis.mitre_attack %}
{{ analysis.mitre_attack.tactic or 'Unknown' }}
{{ analysis.mitre_attack.technique_id or 'Unknown' }} - {{ analysis.mitre_attack.technique_name or '' }}
{% if analysis.mitre_attack.sub_technique %}
{{ analysis.mitre_attack.sub_technique }}
{% endif %}
{% else %}
N/A
{% endif %}
Risk Assessment
{% if analysis.risk %}
{{ analysis.risk.severity or 'Unknown' }}
Confidence: {{ analysis.risk.confidence or 'Unknown' }}
{{ analysis.risk.impact or '' }}
{% else %}
N/A
{% endif %}
🛡️ Mitigations
{% if analysis.mitigations %}
{% if analysis.mitigations.immediate %}
⚡ Immediate Actions
{% for item in analysis.mitigations.immediate %}
- {{ item }}
{% endfor %}
{% endif %}
{% if analysis.mitigations.short_term %}
📅 Short-term
{% for item in analysis.mitigations.short_term %}
- {{ item }}
{% endfor %}
{% endif %}
{% if analysis.mitigations.long_term %}
🎯 Long-term
{% for item in analysis.mitigations.long_term %}
- {{ item }}
{% endfor %}
{% endif %}
{% else %}
No mitigation recommendations available.
{% endif %}
🤔 False Positive Assessment
{% if analysis.false_positive %}
Likelihood: {{ analysis.false_positive.likelihood or 'Unknown' }}
{% if analysis.false_positive.common_causes %}
Common legitimate causes:
{% for cause in analysis.false_positive.common_causes %}
- {{ cause }}
{% endfor %}
{% endif %}
{% else %}
No false positive assessment available.
{% endif %}
{% if analysis.investigate %}
🔍 Investigation Steps
{% for step in analysis.investigate %}
- {{ step }}
{% endfor %}
{% endif %}
📝 Summary
{{ analysis.summary or 'No summary available.' }}
{% if show_mapping and obfuscation_mapping %}
🔐 Obfuscation Mapping
The following sensitive data was replaced with tokens:
{{ obfuscation_mapping | tojson(indent=2) }}
{% endif %}
{% endif %}