refactor: consolidate all LLM prompts into a single folder

contrib/deploy_timesketch.sh

@@ -66,7 +66,7 @@ if [ -z "$(grep vm.max_map_count /etc/sysctl.conf)" ]; then
 fi
 
 # Create dirs
-mkdir -p timesketch/{data/postgresql,data/opensearch,logs,etc,etc/timesketch,etc/timesketch/sigma/rules,upload,etc/timesketch/llm_summarize,etc/timesketch/llm_starred_events_report,etc/timesketch/nl2q}
+mkdir -p timesketch/{data/postgresql,data/opensearch,logs,etc,etc/timesketch,etc/timesketch/sigma/rules,upload,etc/timesketch/llm_prompts}
 # TODO: Switch to named volumes instead of host volumes.
 chown 1000 timesketch/data/opensearch
 
@@ -105,11 +105,12 @@ curl -s $GITHUB_BASE_URL/data/plaso_formatters.yaml > timesketch/etc/timesketch/
 curl -s $GITHUB_BASE_URL/data/context_links.yaml > timesketch/etc/timesketch/context_links.yaml
 curl -s $GITHUB_BASE_URL/contrib/nginx.conf > timesketch/etc/nginx.conf
 curl -s $GITHUB_BASE_URL/data/otel-collector-config.yaml > timesketch/etc/otel-collector-config.yaml
-curl -s $GITHUB_BASE_URL/data/llm_summarize/prompt.txt > timesketch/etc/timesketch/llm_summarize/prompt.txt
-curl -s $GITHUB_BASE_URL/data/llm_starred_events_report/prompt.txt > timesketch/etc/timesketch/llm_starred_events_report/prompt.txt
-curl -s $GITHUB_BASE_URL/data/nl2q/data_types.csv > timesketch/etc/timesketch/nl2q/data_types.csv
-curl -s $GITHUB_BASE_URL/data/nl2q/prompt_nl2q > timesketch/etc/timesketch/nl2q/prompt_nl2q
-curl -s $GITHUB_BASE_URL/data/nl2q/examples_nl2q > timesketch/etc/timesketch/nl2q/examples_nl2q
+curl -s $GITHUB_BASE_URL/data/llm_prompts/llm_summarize_prompt.txt > timesketch/etc/timesketch/llm_prompts/llm_summarize_prompt.txt
+curl -s $GITHUB_BASE_URL/data/llm_prompts/llm_synthesize_prompt.txt > timesketch/etc/timesketch/llm_prompts/llm_synthesize_prompt.txt
+curl -s $GITHUB_BASE_URL/data/llm_prompts/llm_starred_events_report_prompt.txt > timesketch/etc/timesketch/llm_prompts/llm_starred_events_report_prompt.txt
+curl -s $GITHUB_BASE_URL/data/llm_prompts/nl2q_data_types.csv > timesketch/etc/timesketch/llm_prompts/nl2q_data_types.csv
+curl -s $GITHUB_BASE_URL/data/llm_prompts/nl2q_prompt.txt > timesketch/etc/timesketch/llm_prompts/nl2q_prompt.txt
+curl -s $GITHUB_BASE_URL/data/llm_prompts/nl2q_examples.txt > timesketch/etc/timesketch/llm_prompts/nl2q_examples.txt
 echo "OK"
 
 # Create a minimal Timesketch config

data/llm_prompts/README.md

@@ -0,0 +1,22 @@
+# Timesketch LLM Prompts
+
+This directory is the single, unified location for all LLM prompt files used by
+Timesketch's AI-powered features. Consolidating prompts here simplifies
+configuration, maintenance, and discoverability.
+
+## Files
+
+| File | Feature | Config Key |
+|------|---------|-----------|
+| `nl2q_prompt.txt` | Natural Language to Query (NL2Q) | `PROMPT_NL2Q` |
+| `nl2q_examples.txt` | NL2Q few-shot examples | `EXAMPLES_NL2Q` |
+| `nl2q_data_types.csv` | NL2Q data type descriptions | `DATA_TYPES_PATH` |
+| `llm_summarize_prompt.txt` | Event summarization | `PROMPT_LLM_SUMMARIZATION` |
+| `llm_synthesize_prompt.txt` | Investigative question synthesis | `PROMPT_LLM_SYNTHESIZE` |
+| `llm_starred_events_report_prompt.txt` | Starred events forensic report | `PROMPT_LLM_STARRED_EVENTS_REPORT` |
+
+## Customizing Prompts
+
+To use custom prompts, copy this folder to your deployment configuration
+directory (e.g. `/etc/timesketch/llm_prompts/`) and update the corresponding
+paths in `timesketch.conf`.

data/llm_prompts/llm_starred_events_report_prompt.txt

@@ -0,0 +1,17 @@
+You are a highly skilled digital forensic analyst. Your task is to analyze a set of security events, which have been identified as potentially significant ("starred events") in a Timesketch investigation.  Based on these events, generate a concise forensic report summary, formatted in Markdown.
+The title of the report needs to be `# Starred Events Report`.
+Add `[*This report was generated based on <LEN_EVENTS_JSON> (deduplicated) starred events .*]` in the top of the report.
+
+Focus on identifying:
+
+* **Incident Overview:**  Provide a brief summary of what appears to have happened based on these events.  What type of incident is suggested (e.g., unauthorized access, malware infection, data breach attempt)?
+* **Key Findings:**  Highlight the most important observations and indicators from the events. Be specific and mention key entities (usernames, IP addresses, file paths, process names) involved.
+* **Timeline of Significant Events (Chronological Order):** Briefly outline the sequence of key actions observed in the starred events.
+* **Potential Impact/Severity:**  Assess the potential impact or severity of the incident based on the available information.
+* **Recommended Next Steps:** Suggest 2-3 concrete next steps for the investigation based on your analysis.
+
+Use bolding (**...**) for key entities and findings. Format the output as a Markdown document.
+
+IMPORTANT: Return only the raw Markdown content. Do not wrap the response in triple backticks (```) or include any introductory or concluding text aside from the report itself.
+
+Here are the events in JSON format: <events><EVENTS_JSON></events>

data/llm_prompts/llm_summarize_prompt.txt

@@ -0,0 +1,14 @@
+Summarize the following security events to provide a concise overview of what happened.
+
+Identify the main activity or incident described in the events. If the events suggest a security incident, determine if the incident appears to be successful or not, and briefly explain why based on the provided information.
+
+Highlight any key observables mentioned in the events using HTML <strong> tags, such as:
+
+*   IP addresses
+*   Domain names
+*   File paths
+*   Usernames
+*   Process names
+*   Search queries
+
+Events: <events><EVENTS_JSON></events>

data/llm_prompts/llm_synthesize_prompt.txt

@@ -0,0 +1,21 @@
+You are a forensic analyst expert. Your task is to synthesize and then summarize an answer to an investigative question based on a set of conclusions provided by different analysts.
+
+The investigative question is:
+<QUESTION>
+
+Here are the conclusions provided by the analysts:
+<LIST_OF_CONCLUSIONS>
+<CONCLUSIONS>
+</LIST_OF_CONCLUSIONS>
+
+Based on the conclusions provided, please generate a concise answer to the investigative question. Your answer should:
+1.  Directly address the question.
+2.  Summarize the key findings from all conclusions.
+3.  Highlight important indicators of compromise (IOCs), facts, and evidence mentioned in the conclusions.
+4.  Mark IOCs (e.g. "IP addresses", "Domain names", "File paths", "Usernames", "Process names", "Search queries") as bold.
+5.  Build a clear narrative or timeline of events if possible.
+6.  If there are conflicting or uncorroborated points, mention them.
+7.  The final output should be a well-structured text that can be used in a forensic report.
+8.  Format your output with markdown.
+
+Do not include any preamble or postamble. Just provide the summarized answer.