mithra916/IAMpact--Security-Log-Analyzer

# IAMpact — 安全日志分析器 IAMpact 是一个轻量级的 AI 驱动的 IAM 安全分析仪表板，可帮助安全团队分析 AWS CloudTrail IAM 日志、检测可疑的身份活动、确定警报优先级并生成修复建议。 当前版本作为一个交互式的 **CloudTrail 日志分析器**运行，用户可以粘贴 AWS IAM 日志并立即接收经过风险评分的警报。 ## 当前功能 - 直接将 AWS CloudTrail IAM 日志粘贴到仪表板中 - 解析并规范化 IAM 事件 - 检测敏感的 IAM 操作 - 为每个事件分配风险评分 - 将警报分类为 LOW、MEDIUM、HIGH 或 CRITICAL - 高亮显示最高风险的警报 - 显示检测原因 - 生成 AI 风格的修复建议 - 可视化的 SOC 风格仪表板 UI - 采用 FastAPI 后端与 React 前端 ## 工作原理 ``` CloudTrail Logs ↓ Paste into Dashboard ↓ FastAPI Analyzer API ↓ Log Parsing & Normalization ↓ Rule-Based Risk Scoring ↓ Alert Prioritization ↓ AI Recommendation Engine ↓ SOC Dashboard Visualization ``` 检测示例 ``` Input CloudTrail event: { "eventTime": "2026-05-26T10:20:00Z", "eventName": "CreateAccessKey", "sourceIPAddress": "45.67.89.10", "awsRegion": "us-east-1", "userIdentity": { "userName": "admin" } } ``` 输出： Priority: HIGH Risk Score: 65 User: admin Action: CreateAccessKey Source IP: 45.67.89.10 Reasons: - 检测到敏感的 IAM 操作 - 检测到外部源 IP Recommendations: - 调查用户会话 - 验证该活动是否已获授权 - 监控额外的 IAM 活动 ## 项目结构 ``` cloud_sec_intel/ │ ├── backend/ │ ├── app/ │ │ ├── ai/ │ │ ├── api/ │ │ ├── core/ │ │ ├── detection/ │ │ ├── ingestion/ │ │ ├── models/ │ │ ├── parsing/ │ │ ├── schemas/ │ │ ├── services/ │ │ ├── threat_intel/ │ │ ├── websocket/ │ │ └── main.py │ └── requirements.txt │ ├── frontend/ │ ├── src/ │ │ ├── pages/ │ │ │ └── Dashboard.jsx │ │ ├── App.jsx │ │ └── main.jsx │ └── package.json │ ├── docker-compose.yml ├── .gitignore └── README.md ``` ## 技术栈 ``` Backend Python FastAPI Uvicorn Rule-based risk scoring IAM event parsing AI-style recommendation engine Frontend React Vite JavaScript ``` 自定义 SOC 仪表板 UI ▶ 如何在本地运行 ``` 1. Clone the Repository git clone https://github.com/mithra916/IAMpact.git cd IAMpact 2. Run Backend cd backend python -m venv venv venv\Scripts\activate pip install -r requirements.txt uvicorn app.main:app --reload Backend will run at: http://127.0.0.1:8000 API docs: http://127.0.0.1:8000/docs 3. Run Frontend Open new terminal: cd frontend npm install npm run dev Frontend will run at: http://localhost:5173 ``` ## 测试日志 将此内容粘贴到仪表板中： ``` [ { "eventTime": "2026-05-26T10:20:00Z", "eventName": "CreateAccessKey", "sourceIPAddress": "45.67.89.10", "awsRegion": "us-east-1", "userIdentity": { "userName": "admin" } }, { "eventTime": "2026-05-26T10:25:00Z", "eventName": "DeleteTrail", "sourceIPAddress": "185.220.101.45", "awsRegion": "ap-south-1", "userIdentity": { "userName": "cloud-admin" } }, { "eventTime": "2026-05-26T10:30:00Z", "eventName": "ListUsers", "sourceIPAddress": "192.168.1.20", "awsRegion": "ap-south-1", "userIdentity": { "userName": "auditor" } } ] ``` ## 当前仪表板面板 ``` Total logs analyzed Alerts detected Highest risk score Top priority level Severity breakdown Risk score trend IAM action breakdown Top security alert Detected alerts list AI recommendations ``` ## 检测逻辑 ``` IAMpact currently uses rule-based security scoring. Risk factors include: Sensitive IAM actions External source IPs Failed authentication attempts CloudTrail tampering events High-risk AWS API calls Example high-risk actions: CreateAccessKey DeleteAccessKey AttachUserPolicy AttachRolePolicy CreateUser DeleteUser DeactivateMFADevice DeleteTrail StopLogging AssumeRole ConsoleLogin ``` ### 路线图 计划中的未来升级： ``` Real AWS CloudTrail integration STS AssumeRole-based AWS account connection Multi-account monitoring WebSocket live alert streaming Threat intelligence enrichment using AbuseIPDB GeoIP visualization ML-based anomaly detection PostgreSQL alert storage SOC analyst case management Slack or email notifications ``` ## 项目状态 当前状态： ``` ✅ Working CloudTrail Log Analyzer ✅ FastAPI backend ✅ React SOC dashboard ✅ Risk scoring engine ✅ AI recommendation output 🚧 Real-time AWS integration planned 🚧 Threat intelligence enrichment planned 🚧 ML anomaly detection planned ``` ``` Author Loga Mithra R Cybersecurity Student | AI & Security Automation ```

标签：AI安全分析, AMSI绕过, AV绕过, FastAPI, IAM安全, React, Syscalls, 威胁检测, 安全运营, 扫描框架, 数据可视化, 请求拦截, 逆向工具