Skip to content

Conversation

Copy link
Contributor

Copilot AI commented Jan 9, 2026

The AI Assistant generates different TTPs when the same text is pasted versus uploaded as a file. The frontend incorrectly wraps pasted text in a JSON object before sending to the backend, while file content is sent as plain text.

Changes

  • Frontend (AttackPattern.ts): Remove JSON wrapping from text parameter in searchAttackPatternsWithAIWebservice
// Before: text sent as {"text":"content"}
formData.append('text', new Blob([JSON.stringify({ text })], { type: 'application/json' }));

// After: text sent as "content"
formData.append('text', text);

This aligns with the backend's expectation of a plain string @RequestPart("text") and matches how file content is transmitted, ensuring consistent AI webservice input regardless of input method.

Original prompt

This section details on the original issue you should resolve

<issue_title>Different TTPs generated for text vs file input in Scenario Creation with AI Assistance</issue_title>
<issue_description>## Description

When creating a scenario with AI Assistance, the result differs depending on whether the input is pasted text or uploaded as a file.

Environment

  1. OAEV 2.01

Reproducible Steps

Steps to create the smallest reproducible scenario:

  1. Create Scenario with AI assistant
  2. Add this text:
    Once inside the domain controller, the attacker conducted Active Directory reconnaissance using BloodHound to identify high-value targets. Sensitive files were staged in a temporary directory and compressed using 7-Zip. The data was then exfiltrated over HTTPS to a command-and-control server hosted on a cloud VPS, blending in with normal web traffic.

Finally, the attacker attempted to cover their tracks by clearing Windows event logs and deleting temporary tools before terminating the command-and-control channel.

  1. Generate TTps
  2. Now Copy the same text in a file and generate again scenario by using this file
  3. Check Results

Expected Output

Same Result

Actual Output

Different Results

Screenshots (optional)

</issue_description>

Comments on the Issue (you are @copilot in this section)


✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

@savacano28 savacano28 added the filigran team use to identify PR from the Filigran team label Jan 9, 2026
Copilot AI changed the title [WIP] Fix different TTPs generated for text vs file input Fix inconsistent TTP generation between text input and file upload in AI Assistant Jan 9, 2026
Copilot AI requested a review from savacano28 January 9, 2026 15:54
@savacano28 savacano28 changed the title Fix inconsistent TTP generation between text input and file upload in AI Assistant [frontend] fix: fix inconsistent TTP generation between text input and file upload in AI Assistant (#4708) Jan 9, 2026
@savacano28 savacano28 changed the title [frontend] fix: fix inconsistent TTP generation between text input and file upload in AI Assistant (#4708) [frontend] fix: remove wrong key for text input in creation Scenario with AI Assistant (#4708) Jan 9, 2026
@savacano28 savacano28 marked this pull request as ready for review January 9, 2026 15:59
@codecov
Copy link

codecov bot commented Jan 9, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 50.57%. Comparing base (b8c0b6a) to head (9920bcb).

Additional details and impacted files
@@            Coverage Diff            @@
##             master    #4709   +/-   ##
=========================================
  Coverage     50.57%   50.57%           
- Complexity     3708     3709    +1     
=========================================
  Files           903      903           
  Lines         26819    26819           
  Branches       2012     2012           
=========================================
+ Hits          13563    13565    +2     
+ Misses        12437    12435    -2     
  Partials        819      819           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@savacano28 savacano28 force-pushed the copilot/fix-ttp-difference-inputs branch from 9006088 to a164589 Compare January 9, 2026 16:18
@savacano28 savacano28 force-pushed the copilot/fix-ttp-difference-inputs branch 3 times, most recently from d152d86 to b6d6c1e Compare January 9, 2026 16:26
@savacano28 savacano28 force-pushed the copilot/fix-ttp-difference-inputs branch from b6d6c1e to 9920bcb Compare January 9, 2026 16:27
@OpenAEV-Platform OpenAEV-Platform deleted a comment from github-actions bot Jan 9, 2026
@OpenAEV-Platform OpenAEV-Platform deleted a comment from github-actions bot Jan 9, 2026
@savacano28
Copy link
Contributor

Tested OK!

@savacano28 savacano28 assigned savacano28 and unassigned savacano28 Jan 9, 2026
@savacano28 savacano28 requested review from johanah29 and savacano28 and removed request for savacano28 January 12, 2026 08:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

filigran team use to identify PR from the Filigran team

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Different TTPs generated for text vs file input in Scenario Creation with AI Assistance

2 participants