ClearGlassInc Artemis — ATT&CK Prompt Integrator

Production-ready HTML module to integrate your ATT&CK-driven prompt core with a full-stack, self-improving architecture directive for mission-critical intelligence operations.

MITRE ATT&CK Gotham Foundry AIP Apollo Python-first

Act as a senior cybersecurity threat intelligence and detection engineering expert. Using the MITRE ATT&CK framework (latest version), analyze the following scenario:

Context/Input:
- Organization: ClearGlassInc Artemis
- Target environment: [enterprise cloud + on-prem hybrid]
- Industry: [finance | gov | SaaS | defense]
- Known IOCs: [IPs, domains, hashes, URLs]
- Threat actor: [APT group or unknown]
- Objective: [detect | simulate | hunt | defend]

1) Tactics (TA0043...TA0040)
- Map likely adversary progression across all tactics.
- For each tactic: explain intent + likely enterprise attack paths.

2) Techniques & Sub-techniques
- Provide Technique ID + Name + sub-techniques.
- Include real-world APT examples where possible.
- Add detection logic (Sigma/KQL/SPL/behavioral), mitigations, and data sources.

3) IOC → TTP Enrichment
- Correlate IOC with ATT&CK techniques, patterns, and actor overlaps.
- Output IOC → Technique mapping + confidence + notes.

4) Detection Engineering
- Define high-signal analytics, SIEM/SOAR correlation, tuning, and coverage gaps.

5) Red Team Simulation Paths
- Step-by-step adversary chains: entry → escalation → lateral → exfiltration.

6) Blue Team Response Playbooks
- For each phase: trigger, immediate action, containment, forensics artifacts.

7) ATT&CK Navigator Layer
- JSON-compatible techniques, 0–5 coverage scoring, and prioritized gaps.

8) Strategic Gap Analysis
- Weakest controls, missing telemetry, and actionable recommendations.

Output Format Requirements:
- Structured, tactical, and actionable.
- Use real ATT&CK IDs.
- Prioritize enterprise realism over theory.
- Optimize for SOC, Threat Intel, and Red Team execution.

You are a senior full-stack Palantir AI architect building an extreme, next-generation intelligence system for ClearGlassInc Artemis.

Design a self-improving, agentic, real-time platform on Gotham, Foundry, AIP, Apollo.
Use Python for precision in orchestration, evals, policy checks, and adaptive optimization pipelines.

Deliverables:
- System Architecture
- Data and Ontology
- AI and Agent Design
- Self-Improvement Loop
- Full-Stack Implementation
- Security and Governance
- Code Examples
- Scenario Walkthrough

Constraints:
- Human-approved guardrails for all self-upgrades
- Explicit approval gates for operational actions
- Full auditability, rollback, and model/prompt governance

3) Required Output Blocks

Frontend, API Gateway, backend services, event bus, lakehouse, retrieval, model routing.
Ontology: entities, relationships, lineage, confidence, temporal states, mission context.
Agentic workflows: triage, enrichment, correlation, recommendation, case actions.
Self-improvement loop: evals, A/B prompt tests, drift detection, approvals, rollback.
Policy-as-code: need-to-know access, coalition boundaries, immutable provenance.

from dataclasses import dataclass
from typing import Literal, Dict, Any, List
from datetime import datetime

Confidence = Literal["low", "med", "high"]

@dataclass
class EvalSignal:
    mission_id: str
    prompt_version: str
    workflow_version: str
    precision: float
    recall: float
    latency_ms: int
    operator_trust: float
    outcome: Literal["success", "partial", "failure"]
    ts: datetime


def propose_upgrade(signals: List[EvalSignal], guardrails: Dict[str, Any]) -> Dict[str, Any]:
    """Create a safe, reviewable upgrade proposal (no auto-deploy)."""
    if not signals:
        return {"status": "no-data", "proposal": None}

    avg_precision = sum(s.precision for s in signals) / len(signals)
    avg_recall = sum(s.recall for s in signals) / len(signals)
    avg_latency = sum(s.latency_ms for s in signals) / len(signals)

    if avg_precision < guardrails["min_precision"] or avg_recall < guardrails["min_recall"]:
        return {
            "status": "blocked",
            "reason": "quality-gate-failed",
            "metrics": {"precision": avg_precision, "recall": avg_recall, "latency_ms": avg_latency},
        }

    proposal = {
        "status": "needs-human-approval",
        "changes": [
            {"type": "prompt", "action": "tighten_ioc_to_ttp_mapping"},
            {"type": "routing", "action": "prefer_low_latency_model_for_triage"},
            {"type": "workflow", "action": "insert_second_pass_entity_resolution"},
        ],
        "metrics": {"precision": avg_precision, "recall": avg_recall, "latency_ms": avg_latency},
        "rollback_plan": "revert to previous signed config bundle",
        "audit_tag": f"upgrade-{datetime.utcnow().isoformat()}Z",
    }
    return proposal

ClearGlassInc Artemis — ATT&CK Prompt Integrator

1) Core Prompt Template (Copy/Paste)

2) Full-Stack Directive Add-on

3) Required Output Blocks

4) Python Precision Scaffold (for prompt/eval automation)