A self-running security operations system. It streams logs from three AWS sources, learns what normal looks like, recognizes multi-stage attacks, writes the incident report with Claude, and shuts the threat down on its own.
Every stage runs automatically and feeds the next. Keep scrolling — the page traces one full attack, end to end, exactly the way the system sees it.
An async Python engine pulls CloudTrail, VPC Flow Logs, and CloudWatch in parallel through a single event queue — a slow source never blocks the rest. Real attacks leave traces in more than one place, so the system watches all three.
An Isolation Forest model trains on real activity, then scores every new event for deviation — unusual hours, new IPs, high-risk API calls, error spikes. Normal traffic stays quiet; outliers get flagged. The same approach enterprise tools like Darktrace use.
Single events rarely tell the story. The correlation engine stitches events across sources into known chains — failed logins, then a success, then privilege escalation reads as one brute-force takeover, not three unrelated blips.
Each confirmed threat goes to Claude, which returns a full report: executive summary, technical narrative, MITRE ATT&CK mapping, affected resources, and prioritized response steps — the part that usually needs a human analyst.
When severity crosses the threshold, the responder acts without waiting: it blocks the attacker IP, applies an emergency lockdown to the compromised user, raises a CloudWatch alarm, and writes a timestamped audit trail for forensics.
A Flask dashboard surfaces the whole pipeline — events analyzed, anomalies, attack chains, AI reports, and every action the system took — and the entire stack ships in a Docker container, so it runs anywhere.
// detection → containment · under five seconds · zero clicks
Detection, AI analysis, and automated response — all visible as it happens. Served by Flask, shipped in Docker.
Every layer maps to something production security platforms run at enterprise scale — the same concepts, built solo.
From an empty AWS account to an autonomous detect-and-respond loop: the async ingestion engine, the ML baseline, the correlation rules, the AI analyst integration, the SOAR responder, the dashboard, and the Docker build — every layer designed, written, and debugged by hand. The code is the résumé.