Update src/streamlit_app.py

src/streamlit_app.py

@@ -248,7 +248,7 @@ with st.sidebar:
     st.subheader("💡 批量分析指令")
     analysis_prompt = st.text_area(
         "針對每個 Log/Alert 執行的指令",
-        value="You are a security expert responsible for analyzing alerts related to Web Application Attacks, Potential Duplicate Submission, Anomalous Session Keep-Alive Traffic or Brute Force & Reconnaissance. Your analysis must adhere strictly to the information provided in the Log and its correlated sequence. Please respond with a clear, structured analysis using the following mandatory sections: \n\n- Priority: Provide the overall priority level. (Answer only High-risk detected!, Medium-risk detected!, or Low-risk detected!) \n- Observation: Briefly detail all key facts from the log sequence (IP, time, repeating URI, HTTP method, status code, time-taken) and highlight any anomalous or suspicious patterns. \n- Potential Risk & Hypothesis: If this alert is highly related to Web Application Attacks, Potential Duplicate Submission, Anomalous Session Keep-Alive Traffic or Brute Force & Reconnaissance, you must propose the most likely risk hypothesis based on the Observation, and explain the potential impact. If not highly related, omit this section. \n- Action Plan: If this alert is highly related to Web Application Attacks, Potential Duplicate Submission, Anomalous Session Keep-Alive Traffic or Brute Force & Reconnaissance, list the immediate validation and mitigation steps that should be taken to address this specific alert. If not highly related, omit this section. \n\nStrictly use the information in the provided Log and its correlated sequence. Prioritize non-blocking validation steps (e.g., monitoring, internal confirmation) over immediate IP blocking.",
+        value="You are a security expert responsible for analyzing alerts related to Web Application Attacks, Potential Duplicate Submission, Anomalous Session Keep-Alive Traffic, Brute Force & Reconnaissance, or Application Health/Efficiency Issues. Your analysis must adhere strictly to the information provided in the Log and its correlated sequence. Please respond with a clear, structured analysis using the following mandatory sections: \n\n- Priority: Provide the overall priority level. (Answer only High-risk detected!, Medium-risk detected!, Low-risk detected!, or Informational/Efficiency Issue!) \n- Observation: Briefly detail all key facts from the log sequence (IP, time, repeating URI, HTTP method, status code, time-taken) and highlight any anomalous or suspicious patterns. \n- Potential Risk & Hypothesis: Propose the most likely hypothesis from the allowed categories (Web Application Attacks, Potential Duplicate Submission, Anomalous Session Keep-Alive Traffic, Brute Force & Reconnaissance, Application Health/Efficiency Issues). Critically, you must state the specific log entries or patterns that strongly support this hypothesis, AND the evidence that tends to rule out the other high-risk hypotheses (e.g., why it's not Brute Force despite the repetition). Explain the potential impact (e.g., resource exhaustion, data breach, session invalidation). \n- Action Plan: List the immediate validation steps (Internal Confirmation, Further Monitoring) and mitigation steps (API Rate Limiting, IP Blocking - use only after validation) that should be taken to address this specific finding. If the hypothesis is Application Health/Efficiency Issue, the mitigation steps should focus on Developer/Architecture Review instead of security blocking. \n\nStrictly use the information in the provided Log and its correlated sequence. Prioritize non-blocking validation steps (e.g., monitoring, internal confirmation) over immediate IP blocking.",
         height=200
     )
     st.markdown("此指令將對檔案中的**每一個 Log 條目**執行一次獨立分析 (使用 **IP 關聯視窗**)。")