AI-Augmented Threat Detection in Resource-Constrained SIEM Environments
This repository implements a fully autonomous Security Operations Center (SOC) that operates within < 300 MB total RAM on a single edge node. Four interlocking defensive layers — a WAF, honeypots, an AI triage engine, and automated active response — detect, classify, and contain multi-vector cyber attacks without human intervention.
→ For the complete architectural deep-dive, see project_overview.md.
Project_10/
├── project-1-siem/ # Wazuh SIEM Baseline (Manager + Indexer + Dashboard)
├── project-2-soc-bot/ # AI SOC Analyst — LLM Triage Engine (The Brain)
├── project-3-phishing-analyzer/ # Multi-Method Phishing Email Classifier
├── project-4-waf/ # ModSecurity WAF + DVWA Lab (The Shield)
├── project-5-honeypot/ # Cowrie + OpenCanary Honeypots (The Trap)
├── project-6-benchmarks/ # Performance Validation (< 300 MB proof)
├── project-10-synthesis/ # Comparative Analysis Documents
├── project-11-integration/ # End-to-End Kill-Chain Integration Tests
├── project-12-showcase/ # Streamlit Academic Demo Dashboard
├── tests/ # pytest Integration Test Suite
├── thesis/ # Academic Thesis Documents & Literature
├── Makefile # Full Lifecycle Automation (see below)
├── project_overview.md # Master Architectural Overview
├── repository_audit_report.md # Security & Misconfiguration Audit
├── deploy.sh # Stack Orchestration Script
└── teardown.sh # Stack Decommissioning Script
Each subproject directory contains its own README.md with detailed setup instructions.
# 1. Configure credentials
cp .env.example .env
# Edit .env with your Mistral, Groq, and Wazuh API keys
# 2. Deploy the defensive stack
make deploy
# 3. Run the full demo lifecycle (recommended for evaluation)
make demoThe root Makefile provides complete lifecycle automation for academic evaluation:
| Target | Description |
|---|---|
make help |
Display all available targets |
make setup |
Pull Docker images and generate TLS certificates |
make up |
Start the full Wazuh SIEM stack |
make down |
Stop and remove all containers |
make deploy |
Deploy WAF + Honeypot containers |
make teardown |
Tear down WAF + Honeypot stack |
make killchain |
Run the live kill-chain simulation (WAF → Honeypot) |
make triage |
Execute AI triage on live container logs |
make hashchain |
Build SHA-256 log integrity chain (E1) |
make hallucination |
Run MITRE ATT&CK hallucination checker (E5) |
make dashboard |
Launch the Streamlit showcase dashboard |
make demo |
Full lifecycle: deploy → killchain → dashboard |
make test |
Run pytest integration tests |
make bench |
Run performance benchmarks |
make evaluate |
Run the AI evaluation harness (720 LLM calls) |
make tree |
Display the project directory tree |
make clean |
Remove Docker volumes and temp files |
For Reviewers: Use
make demofor a single-command, full-lifecycle evaluation of the architecture. This deploys the WAF and honeypot, simulates a multi-vector kill-chain, and launches the interactive dashboard athttp://localhost:8501.
| Container | Peak RAM | Status |
|---|---|---|
| WAF (ModSecurity) | ~73.93 MB | ✅ |
| DVWA (Backend) | ~152.50 MB | ✅ |
| Cowrie (Honeypot) | ~49.67 MB | ✅ |
| Total | < 300 MB | ✅ Verified |
- Dataset: 120 synthetic alerts (seed=42), 86 true positives / 34 false positives
- Matrix: 2 providers × 3 prompt variants × 120 alerts = 720 LLM API calls
- Metrics: Weighted F1-score, p95 latency, confusion matrices per provider-prompt cell
- Results: Stored in
project-2-soc-bot/evaluation/metrics_summary.json
| Port | Service | Conflict Resolution |
|---|---|---|
| 80 | WAF (ModSecurity) | Change to 8080:80 in project-4-waf/docker-compose.yml |
| 2222 | Cowrie Honeypot | Change to 2223:2222 in project-5-honeypot/docker-compose.yml |
| 8501 | Streamlit Dashboard | Use streamlit run app.py --server.port 8502 |
| 55000 | Wazuh Manager API | Modify project-1-siem/docker/docker-compose.yml |
Academic research project — Master's Thesis evaluation workspace.