How ondrej-polak/llm-rag-vuln-triage works
The product is a local vulnerability-assessment assistant: users upload Nmap XML, review parsed services, and request an evidence-linked triage report. The app parses and formats scan findings, enriches application CPEs with NVD CVEs tagged against CISA KEV, stores both evidence types in Chroma, then retrieves evidence for a local-LLM assessment and report export. The graph reflects the sampled app and runtime modules; the README is empty, and unsampled module details and deployment wiring are omitted.
Main entry points: app.py Scan orchestration · rag.py RAG chain · nvd.py CVE enrichment · kev.py KEV index
Components 18
User workflow
- Streamlit interface
app.py - Scan orchestration
app.py - Assessment and export
app.py
Finding enrichment
- XML parser
parser.py - Finding formatter
parser.py - KEV index
kev.py - KEV cache
kev.py - CVE enrichment
nvd.py
Evidence storage
- Chroma collection
app.py - Ollama embeddings
app.py
Triage analysis
- RAG chain
rag.py - Evidence retriever
rag.py - Triage prompt
rag.py
Other components
- Scan user
- Nmap XML
- CISA catalogue
- NVD API
- Ollama LLM
Connections 26
- Scan user → Streamlit interface: uploads scan
- Nmap XML → Streamlit interface: provides XML
- Streamlit interface → Scan orchestration: starts processing
- Scan orchestration → XML parser: parses XML
- XML parser → Finding formatter: returns hosts
- Scan orchestration → Finding formatter: formats findings
- Streamlit interface → KEV index: loads catalogue
- KEV index → KEV cache: reads or writes
- KEV index → CISA catalogue: downloads catalogue
- Scan orchestration → CVE enrichment: enriches hosts
- CVE enrichment → KEV index: checks CVE status
- CVE enrichment → NVD API: queries CVEs
- CVE enrichment → Scan orchestration: returns CVE chunks
- Scan orchestration → Ollama embeddings: requests embeddings
- Scan orchestration → Chroma collection: upserts evidence
- Ollama embeddings → Chroma collection: embeds documents
- Scan orchestration → RAG chain: builds analysis
- RAG chain → Chroma collection: creates retriever
- RAG chain → Evidence retriever: configures retrieval
- RAG chain → Triage prompt: assembles chain
- RAG chain → Ollama LLM: invokes model
- Streamlit interface → RAG chain: invokes chain
- Streamlit interface → Evidence retriever: fetches evidence
- Evidence retriever → Chroma collection: searches evidence
- Streamlit interface → Assessment and export: renders and exports
- Scan user → Assessment and export: views or downloads