I built the Security Copilot UI for GENESIS AI, which is reachable at the primary root navigation route (/). Every user message triggers an autonomous 6‑stage investigation workflow streamed in real time to the frontend via Server‑Sent Events (SSE).
- 6‑Stage Pipeline: Understanding → Tool Execution → Correlation → MITRE Mapping → Policy Eval → Grounded Synth.
POST /api/v1/chat/conversations/{conversation_id}/stream
- SSE event types and example payloads:
- handshake:
{"status": "INITIALIZED", "conversationId": str, "userMessageId": str} - step:
{"step": "retrieving" | "correlating" | "mapping" | "evaluating" | "synthesizing", "label": str} - actions:
{"actions": [{"proposalId": str, "actionName": str, "target": str, "status": "pending"}]} - token:
{"delta": str} - done:
{"messageId": str, "conversationId": str, "tokenCount": int}
- handshake:
To keep conceptual queries from being hijacked by attached log files, I guard log ingestion behind the is_explicit_file_query flag, which only activates when the user prefixes a request with ### Log Analysis: <filename>; otherwise all questions are routed to the CyberKnowledgeEngine.