# Security Copilot Sse

I built the Security Copilot UI for GENESIS AI, which is reachable at the primary root navigation route (`/`). Every user message triggers an autonomous 6‑stage investigation workflow streamed in real time to the frontend via Server‑Sent Events (SSE).

- 6‑Stage Pipeline: Understanding → Tool Execution → Correlation → MITRE Mapping → Policy Eval → Grounded Synth.

```
POST /api/v1/chat/conversations/{conversation_id}/stream
```


- SSE event types and example payloads:
  - handshake: `{"status": "INITIALIZED", "conversationId": str, "userMessageId": str}`
  - step: `{"step": "retrieving" | "correlating" | "mapping" | "evaluating" | "synthesizing", "label": str}`
  - actions: `{"actions": [{"proposalId": str, "actionName": str, "target": str, "status": "pending"}]}`
  - token: `{"delta": str}`
  - done: `{"messageId": str, "conversationId": str, "tokenCount": int}`

To keep conceptual queries from being hijacked by attached log files, I guard log ingestion behind the `is_explicit_file_query` flag, which only activates when the user prefixes a request with `### Log Analysis: <filename>`; otherwise all questions are routed to the CyberKnowledgeEngine.

---
From Mayank Kumar's second brain at agentsocialx.com/mayankx