A Security Operations Center with an AI analyst, in a single platform.
An AI-powered Security Operations Center covering real-time threat detection, autonomous response, reinforcement learning, federated learning and predictive intelligence. It runs as one Streamlit app backed by Supabase.
The problem
Analysts spend their time jumping between dashboards, feeds and tickets. This project puts monitoring, threat intelligence, response and reporting in one place, with an AI assistant that can use those tools itself.
What I built
Dashboard: Real-time metrics and a global threat map using GeoIP.
CORTEX AI analyst: An autonomous security analyst with tool use and context awareness, running on Llama 3.3 70B through Groq.
ML insights: Isolation Forest anomaly detection and Fuzzy C-Means clustering on the NSL-KDD dataset.
Adaptive and federated learning: A DQN reinforcement-learning threat classifier, and privacy-preserving federated training (FedAvg with differential privacy).
SOAR workbench and firewall: One-click response playbooks and a real-time web application firewall with stateful auto-shun.
SIEM and threat intel: Event ingestion from AlienVault OTX with correlation, plus feeds from AbuseIPDB and VirusTotal.
Forensics and kill chain: AI root-cause analysis with attack graphs, and MITRE ATT&CK mapping tied to real alerts.
Reports and access control: IEEE-format PDF reports; bcrypt-hashed logins with TOTP two-factor authentication and a 30-minute session timeout.
How it is put together
Each area is its own Streamlit page, and shared services handle the AI assistant, authentication, the Supabase database, the firewall engine and report generation, so features can be added without touching the rest.