kencherian/Aegis-SecOps-Platform
GitHub: kencherian/Aegis-SecOps-Platform
一款结合大语言模型的多租户安全信息与事件管理平台，实现安全遥测自动摄入、向量化历史检索与 AI 驱动的自动化威胁遏制剧本生成。
Stars: 0 | Forks: 0
# AEGIS Quantum-Orchestrator SecOps 平台
一款精英级、高吞吐量的安全信息与事件管理 (SIEM) 系统，结合自主的安全编排、自动化与响应 (SOAR) 生态系统，专为自动化的多租户威胁检测与遏制闭环而设计。
## 🛡️ 架构概述
AEGIS 平台将传统的安全运营中心 (SOC) 转化为超级自动化的智能体防御网络。通过摄取跨端点、身份和网络通道的非结构化遥测数据，它将威胁指纹向量化以执行历史上下文解析，并运行解耦的 AI 推理引擎来生成确定性的缓解步骤。
### 系统拓扑
+-----------------------------------------------------------------------------------------+
| Next.js 客户端仪表盘界面 |
+-----------------------------------------------------------------------------------------+
|
| (安全的 HTTPS REST 调用)
v
+-----------------------------------------------------------------------------------------+
| FastAPI (Python) 安全摄取引擎 |
+-----------------------------------------------------------------------------------------+
/
/ (加密的 Postgres 同步) \ (智能体 Playbook Prompts)
v v
+----------------------------------+ +----------------------------------+
| Supabase 云端数据库集群 | | Google Gemini API 框架 |
| - 已激活行级安全策略 | | - text-embedding-004 (768 维) |
| - pgvector HNSW 空间搜索 | | - gemini-2.5-flash (JSON 输出) |
+----------------------------------+ +----------------------------------+
## 🛠️ 技术栈蓝图
* **前端页面层：** Next.js 14 + TypeScript (针对 Vercel Edge 网络进行优化)
* **API 服务核心：** FastAPI (Python 3.10+)，实现闪电般的异步操作
* **数据库与存储舱：** 经 Row Level Security (RLS) 加固的 Supabase PostgreSQL
* **向量空间搜索引擎：** PostgreSQL `pgvector`，解析 768 维矩阵
* **自主智能引擎：** Google Gemini (`text-embedding-004` 和 `gemini-2.5-flash`)
## 🚀 逐步执行指南
### 1. 前置环境
在配置依赖项之前，请确保您的机器上运行了本地版本的 **Node.js (LTS)** 和 **Python 3.10+**。
### 2. 数据库 Schema 配置
登录您的 Supabase 仪表盘，打开 **SQL Editor**，并运行初始化脚本：
```
CREATE EXTENSION IF NOT EXISTS pgvector WITH SCHEMA extensions;
CREATE TYPE alert_severity_level AS ENUM ('LOW', 'MEDIUM', 'HIGH', 'CRITICAL');
CREATE TYPE workflow_status_state AS ENUM ('PENDING', 'INVESTIGATING', 'MITIGATED', 'FALSE_POSITIVE');
CREATE TABLE public.security_alerts (
id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
tenant_id UUID NOT NULL,
source_system VARCHAR(100) NOT NULL,
event_title TEXT NOT NULL,
raw_payload JSONB NOT NULL,
severity alert_severity_level NOT NULL DEFAULT 'MEDIUM',
status workflow_status_state NOT NULL DEFAULT 'PENDING',
payload_embedding extensions.vector(768),
created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
);
ALTER TABLE public.security_alerts ENABLE ROW LEVEL SECURITY;
3. Backend Engine Boot Sequence
Navigate into the /backend folder, set up your configuration file, and start the local runtime execution thread:
Bash
cd backend
python -m venv venv
# 激活 virtual environment (Windows: venv\Scripts\activate | Mac: source venv/bin/activate)
pip install -r requirements.txt
python -m uvicorn app.main:app --reload
Your local backend configuration file (backend/.env) must resemble the following layout:
Code snippet
SUPABASE_URL=[https://your-project-id.supabase.co](https://your-project-id.supabase.co)
SUPABASE_SERVICE_ROLE_KEY=your-secret-bypass-service-role-key
GEMINI_API_KEY=your-gemini-api-developer-key
4. Frontend Compilation & Local Startup
Navigate into the /frontend directory, bind your local key environments, and launch your client server:
Bash
cd frontend
npm install
npm run dev
Your client environment configuration workspace file (frontend/.env.local) must look like this:
Code snippet
NEXT_PUBLIC_SUPABASE_URL=[https://your-project-id.supabase.co](https://your-project-id.supabase.co)
NEXT_PUBLIC_SUPABASE_ANON_KEY=your-public-anonymous-token
NEXT_PUBLIC_API_BASE_URL=http://localhost:8000
🔒 Enterprise Guardrails & Zero-Trust Architecture
Granular Isolation Filters: Data tables reject direct anonymous write or read updates. All transactional data routing passes securely through administrative server checks.
Type Safety Assurance: The codebase handles structural components using strict TypeScript interfaces and Pydantic validation contracts to prevent formatting vulnerabilities.
Deterministic Intelligence Routing: The AI generation parameters enforce strict JSON formatting templates at low temperature settings (temperature=0.1), eliminating reasoning variance.
🌐 Continuous Integration & Cloud Infrastructure
Frontend Deployments Layer: Hosted natively via Vercel Production pipelines with Edge routing optimizations.
Live Production Testing Endpoint: Access the interface securely on the web grid network at: https://aegis-frontend-orchestrator.vercel.app
```
标签：AI安全, AMSI绕过, AV绕过, Chat Copilot, FastAPI, SOAR, 威胁检测, 安全运营, 扫描框架, 测试用例, 自动化响应, 自动化攻击, 逆向工具