Find ATT&CK techniques hidden in threat reports

import { SIEClient } from '@superlinked/sie-sdk';

const client = new SIEClient(undefined, { apiKey: 'sk-sie-…' });

const result = await client.extract(
  'fastino/gliner2-large-v1',
  { text: "The threat actor is then able to use the stolen session cookie to log in as the victim where they can take multiple actions like changing the password, copying data, or pretending to be the victim" },
  { labels: ["threat actor","software tool","credential","target system"] },
);
console.log(result.entities);

curl https://api.superlinked.com/v1/extract/fastino%2Fgliner2-large-v1 \
  -H "Authorization: Bearer sk-sie-…" \
  -H "Content-Type: application/json" \
  -d "{\"items\":[{\"text\":\"The threat actor is then able to use the stolen session cookie to log in as the victim where they can take multiple actions like changing the password, copying data, or pretending to be the victim\"}],\"params\":{\"labels\":[\"threat actor\",\"software tool\",\"credential\",\"target system\"]}}"

import { unpackMessage } from '@superlinked/sie-sdk';

const query = "Actor: threat actor\nAction: use\nObject: stolen session cookie\nTool: Evilginx2\nTarget: victim\nAssertion: observed\nEvidence: The threat actor is then able to use the stolen session cookie to log in as the victim where they can take multiple actions like changing the password, copying data, or pretending to be the victim";
const documents = [
  "ATT&CK technique: T1550.004 Web Session Cookie\nDescription: Adversaries can use stolen session cookies to authenticate to web applications and services.",
  "ATT&CK technique: T1539 Steal Web Session Cookie\nDescription: An adversary may steal web application or service session cookies and use them to gain authenticated access.",
  "ATT&CK technique: T1606.001 Web Cookies\nDescription: Adversaries may forge new web cookies to gain access to web applications or Internet services.",
  "ATT&CK technique: T1185 Browser Session Hijacking\nDescription: Adversaries may change browser content, modify user behavior, or intercept information inside a browser session.",
  "ATT&CK technique: T1134.001 Token Impersonation/Theft\nDescription: Adversaries may duplicate and impersonate another user’s existing operating-system token.",
];

async function encode(texts: string[], isQuery = false): Promise<Float32Array[]> {
  const response = await fetch("https://api.superlinked.com/v1/encode/Qwen%2FQwen3-Embedding-8B", {
    method: 'POST',
    signal: AbortSignal.timeout(30_000),
    headers: {
      Authorization: "Bearer sk-sie-…",
      'Content-Type': 'application/json',
      Accept: 'application/msgpack',
    },
    body: JSON.stringify({
      items: texts.map((text) => ({ text })),
      params: { output_types: ['dense'], ...(isQuery ? { options: { is_query: true } } : {}) },
    }),
  });
  if (!response.ok) throw new Error(`SIE returned ${response.status}`);
  const result = unpackMessage<{ items: { dense: { values: Float32Array } }[] }>(
    new Uint8Array(await response.arrayBuffer()),
  );
  return result.items.map((item) => item.dense.values);
}

const [q] = await encode([query], true);
const docs = await encode(documents);
const cosine = (a: Float32Array, b: Float32Array) => {
  const dot = a.reduce((s, x, i) => s + x * b[i]!, 0);
  return dot / (Math.hypot(...a) * Math.hypot(...b));
};
const ranked = documents
  .map((doc, i) => ({ doc, score: cosine(q!, docs[i]!) }))
  .sort((a, b) => b.score - a.score);
console.log(ranked);

# Encode the query with is_query, then the candidates; rank by cosine.
curl https://api.superlinked.com/v1/encode/Qwen%2FQwen3-Embedding-8B \
  -H "Authorization: Bearer sk-sie-…" \
  -H "Content-Type: application/json" \
  -d "{\"items\":[{\"text\":\"Actor: threat actor\\nAction: use\\nObject: stolen session cookie\\nTool: Evilginx2\\nTarget: victim\\nAssertion: observed\\nEvidence: The threat actor is then able to use the stolen session cookie to log in as the victim where they can take multiple actions like changing the password, copying data, or pretending to be the victim\"}],\"params\":{\"output_types\":[\"dense\"],\"options\":{\"is_query\":true}}}"

curl https://api.superlinked.com/v1/encode/Qwen%2FQwen3-Embedding-8B \
  -H "Authorization: Bearer sk-sie-…" \
  -H "Content-Type: application/json" \
  -d "{\"items\":[{\"text\":\"ATT&CK technique: T1550.004 Web Session Cookie\\nDescription: Adversaries can use stolen session cookies to authenticate to web applications and services.\"},{\"text\":\"ATT&CK technique: T1539 Steal Web Session Cookie\\nDescription: An adversary may steal web application or service session cookies and use them to gain authenticated access.\"},{\"text\":\"ATT&CK technique: T1606.001 Web Cookies\\nDescription: Adversaries may forge new web cookies to gain access to web applications or Internet services.\"},{\"text\":\"ATT&CK technique: T1185 Browser Session Hijacking\\nDescription: Adversaries may change browser content, modify user behavior, or intercept information inside a browser session.\"},{\"text\":\"ATT&CK technique: T1134.001 Token Impersonation/Theft\\nDescription: Adversaries may duplicate and impersonate another user’s existing operating-system token.\"}],\"params\":{\"output_types\":[\"dense\"]}}"

import { SIEClient } from '@superlinked/sie-sdk';

const client = new SIEClient(undefined, { apiKey: 'sk-sie-…' });

const result = await client.chatCompletions({
  model: 'Qwen/Qwen3.6-27B:no-spec',
  messages: [
    { role: 'user', content: "Select the ATT&CK candidate that directly describes this behavior. Keep the evidence quote exact.\n\nBehavior: Threat actor uses stolen session cookie to log in as victim and perform actions\nSource quote: The threat actor is then able to use the stolen session cookie to log in as the victim where they can take multiple actions like changing the password, copying data, or pretending to be the victim\nCandidates: T1539 Steal Web Session Cookie; T1550.004 Web Session Cookie; T1185 Browser Session Hijacking; T1606.001 Web Cookies; T1134.001 Token Impersonation/Theft." },
  ],
  max_completion_tokens: 256,
});
console.log(result.choices[0]?.message.content);

curl https://api.superlinked.com/v1/chat/completions \
  -H "Authorization: Bearer sk-sie-…" \
  -H "Content-Type: application/json" \
  -d "{\"model\":\"Qwen/Qwen3.6-27B:no-spec\",\"messages\":[{\"role\":\"user\",\"content\":\"Select the ATT&CK candidate that directly describes this behavior. Keep the evidence quote exact.\\n\\nBehavior: Threat actor uses stolen session cookie to log in as victim and perform actions\\nSource quote: The threat actor is then able to use the stolen session cookie to log in as the victim where they can take multiple actions like changing the password, copying data, or pretending to be the victim\\nCandidates: T1539 Steal Web Session Cookie; T1550.004 Web Session Cookie; T1185 Browser Session Hijacking; T1606.001 Web Cookies; T1134.001 Token Impersonation/Theft.\"}],\"max_completion_tokens\":256}"