update PLUGINS

DATA/SYSTEM/KNOWLEDGE_EXTRACTION/System.md

@@ -3,13 +3,14 @@
 
 输入格式：
 
-HumanMessage 是一个 JSON 对象，包含三个顶层字段：`case_id`、`case` 和 `discussions`。
+HumanMessage 是一个 JSON 对象，包含三个必选顶层字段：`case_id`、`case` 和 `discussions`，以及一个可选字段 `user_input`。
 
 - `case_id` 是 Case 的人类可读 ID（例如 "case_000123"）。你必须在知识正文中引用此 ID，以便未来读者追溯知识来源。
 - `case` 是已关闭的 Case 及其全部结构化数据 — 告警、实体、富化信息、判定结果、结案摘要、分析师注释、描述、标签等。
 - `discussions` 是案件上的分析师评论和回复列表。每条包含 `message`（评论文本）、`created_at`、`created_by`（作者）、
   `reply_to_author`、`mentions`（被提及的用户列表）和 `attachments`（附件列表）。讨论通常包含最有价值的人工推理：假设、误报理由、手动标注的
   IOC 和操作备注。
+- `user_input`（可选）是分析师触发 Playbook 时提供的额外指引。如果存在，请结合用户输入来调整提取方向 — 它可能指定了关注点、格式偏好或补充背景信息。
 
 ## 何时提取知识
 

DATA/SYSTEM/KNOWLEDGE_EXTRACTION/System_EN.md

@@ -2,11 +2,12 @@ You are a SOC knowledge extraction agent. Your task is to read a closed Case (in
 
 Input format:
 
-The human message is a JSON object with three top-level fields: `case_id`, `case`, and `discussions`.
+The human message is a JSON object with three required top-level fields: `case_id`, `case`, and `discussions`. An optional fourth field `user_input` may also be present.
 
 - `case_id` is the human-readable Case ID (e.g. "case_000123"). You MUST reference this ID in the knowledge body so future readers can trace the knowledge back to its source.
 - `case` is the closed Case with all its structured data — alerts, artifacts, enrichments, verdict, summary, comment, description, tags, and more.
 - `discussions` is a list of analyst comments and replies on the case. Each item contains `message`, `created_at`, `created_by`, `reply_to_author`, `mentions`, and `attachments`. Discussions often contain the most valuable human reasoning: hypotheses, false positive rationale, manually noted IOCs, and operational notes.
+- `user_input` (optional) is additional guidance provided by the analyst when triggering the playbook. If present, use it to inform your extraction — it may specify a focus area, format preference, or supplementary context that should shape the knowledge output.
 
 ## When to extract knowledge
 

PLAYBOOKS/Knowledge_Extraction.py

@@ -37,7 +37,8 @@ class Playbook(BasePlaybook):
         discussions = Case.get_discussions_by_row_id(case_row_id) or []
 
         # 5. Call LLM to extract knowledge
-        extraction = extract_knowledge_from_case(case.id or "", case_json, discussions)
+        user_input = self.param_user_input or ""
+        extraction = extract_knowledge_from_case(case.id or "", case_json, discussions, user_input)
 
         # 6. If no knowledge, log and return success
         if not extraction.has_knowledge:

PLUGINS/SIRP/analysis.py

@@ -303,14 +303,17 @@ class KnowledgeExtractionResult(BaseModel):
     reason: str = Field(description="Brief explanation of the extraction decision. 提取或不提取的简要原因。")
 
 
-def extract_knowledge_from_case(case_id: str, case_json: str, discussions: List[dict[str, Any]]) -> KnowledgeExtractionResult:
+def extract_knowledge_from_case(case_id: str, case_json: str, discussions: List[dict[str, Any]], user_input: str = "") -> KnowledgeExtractionResult:
     system_prompt = KNOWLEDGE_EXTRACTION_PROMPT_PATH.read_text(encoding="utf-8")
     llm = LLMAPI().get_model(tag="structured_output").with_structured_output(KnowledgeExtractionResult)
     try:
         case_data = json.loads(case_json)
     except json.JSONDecodeError:
         case_data = case_json
-    input_json = json.dumps({"case_id": case_id, "case": case_data, "discussions": discussions}, ensure_ascii=False, separators=(",", ":"))
+    input_data = {"case_id": case_id, "case": case_data, "discussions": discussions}
+    if user_input:
+        input_data["user_input"] = user_input
+    input_json = json.dumps(input_data, ensure_ascii=False, separators=(",", ":"))
     result = llm.invoke([
         SystemMessage(content=system_prompt),
         HumanMessage(content=input_json),