AI SOC Assistant

Production-oriented Security Operations Center (SOC) Assistant for investigating security events, analyzing logs, mapping MITRE ATT&CK, generating incident reports, and recommending remediation.

Built as a modular, portfolio-ready platform — not a thin chatbot wrapper.

Features

Module	Capabilities
AI SOC Chat	Event IDs, SIEM alerts, log summaries, malware behavior, remediation, investigation reports
Log Analysis	EVTX, Syslog, JSON, CSV, Wazuh alerts — failed logins, priv-esc, PowerShell abuse, persistence, lateral movement
MITRE ATT&CK	Automatic tactic/technique mapping from observed behavior
Threat Intelligence	VirusTotal, AbuseIPDB, AlienVault OTX, URLhaus
IOC Search	IP, domain, URL, file hash
Malware Analysis	PE info, imports, strings, hashes, YARA, suspicious APIs
Dashboard	Alert stats, severity, incidents, queue, uploads, AI recommendations
Incident Reports	Markdown + PDF (exec summary, timeline, evidence, MITRE, root cause, remediation)
Knowledge Base (RAG)	PDFs, playbooks, Sigma rules, internal docs with retrieval-augmented answers

Architecture

SOC_Assistant/
├── frontend/          # React + Vite + TypeScript + Tailwind + Framer Motion
├── backend/           # FastAPI + SQLAlchemy + JWT auth
├── ai/                # Ollama client, LangGraph-style agent, RAG (Chroma)
├── integrations/      # VT, AbuseIPDB, OTX, URLhaus
├── parsers/           # Log parsers + detection heuristics
├── reports/           # Markdown / PDF incident reports
├── database/          # Models, session, migrations helpers
├── docs/              # Architecture & operator docs
└── docker-compose.yml

Tech Stack

• Frontend: React, Vite, TypeScript, Tailwind CSS, Framer Motion, Recharts
• Backend: FastAPI, Python 3.12+, SQLAlchemy, Pydantic v2, JWT
• Data: PostgreSQL (production), SQLite (local default)
• AI: Ollama (default), optional OpenAI-compatible APIs, ChromaDB, sentence-transformers
• Security concepts: MITRE ATT&CK, Sigma-oriented detections, YARA hooks, SIEM-friendly parsers

Windows desktop app (EXE)

Package the whole product as a native window (WebView2) with one launcher:

powershell -ExecutionPolicy Bypass -File desktop\build_windows.ps1

Then run:

dist\AI_SOC_Assistant\AI_SOC_Assistant.exe

See docs/DESKTOP_APP.md for details. Distribute the entire AI_SOC_Assistant folder.

Dev desktop mode (no PyInstaller):

cd frontend; npm run build; cd ..
$env:PYTHONPATH="$PWD;$PWD\backend"
.\backend\.venv\Scripts\python.exe desktop\run_app.py

Quick Start (local browser)

Prerequisites

• Python 3.12+
• Node.js 20+
• Optional: Ollama with a chat model (e.g. llama3.2)
• Optional: Docker / Docker Compose

1. Environment

cp .env.example .env
# Edit API keys and secrets as needed

2. Backend

cd backend
python -m venv .venv

# Windows
.venv\Scripts\activate

# Linux/macOS
# source .venv/bin/activate

pip install -r requirements.txt
set PYTHONPATH=..   # Windows PowerShell: $env:PYTHONPATH=".."
uvicorn app.main:app --reload --host 0.0.0.0 --port 8000

API docs: http://localhost:8000/docs

Default admin (created on first run if missing):

• Email: [email protected]
• Password: ChangeMeNow!

3. Frontend

cd frontend
npm install
npm run dev

UI: http://localhost:5173

4. Docker (optional)

docker compose up --build

Configuration

See .env.example for:

• DATABASE_URL, SECRET_KEY, CORS_ORIGINS
• OLLAMA_BASE_URL, OLLAMA_MODEL
• OPENAI_API_KEY / ANTHROPIC_API_KEY (optional)
• VIRUSTOTAL_API_KEY, ABUSEIPDB_API_KEY, OTX_API_KEY

Without TI API keys, integrations return structured mock/demo responses so the UI remains usable offline.

Security notes

• Change SECRET_KEY and default admin password before any real deployment.
• Store TI API keys only in environment / secret managers.
• Do not upload real production evidence to public demos without sanitization.

Documentation

• Architecture
• API overview
• Operator guide

License

MIT — for educational and portfolio use. Validate all automated findings with human analysts.