revanthkaraka/SOC-AI-Builder

# AI 驱动的事件响应仪表板 一个自动化的 SOC 分析师助手，能够摄取原始、非结构化的安全日志（Syslog、Nmap、Snort 等），并通过 Google AI Studio 使用 Gemini 2.5 Flash 即时生成结构化的 JSON 遥测数据、按时间顺序的攻击时间线以及精确的缓解脚本。 ## 🚀 功能 - **原始日志转叙述：** 将密集、晦涩的网络日志转换为人类可读的事件摘要。 - **按时间顺序的攻击时间线：** 重建攻击者采取的确切步骤，标记其 IP 和入口向量。 - **自动化修复：** 生成量身定制的、可直接复制粘贴的配置调整或终端命令（`iptables`、防火墙规则），以遏制活跃威胁。 - **响应式 SOC 布局：** 采用 React 和 TailwindCSS 构建的简洁深色模式终端界面，专为快速态势感知而设计。 ## 🛠️ 技术栈 - **前端：** React (Vite)、TailwindCSS - **后端：** Python、FastAPI、Uvicorn - **AI 核心：** Google AI Studio SDK (`google-genai`)、Gemini 2.5 Flash ## 📁 项目结构 ``` ├── backend/ │ ├── main.py # FastAPI application & Gemini API orchestration │ └── requirements.txt # Python dependencies └── frontend/ ├── src/ │ ├── App.jsx # Dashboard UI components │ └── main.jsx ├── package.json └── tailwind.config.js ⚙️ Installation & Setup Prerequisites Python 3.9+ Node.js (v18+) A Google AI Studio API Key 1. Backend Setup Navigate to the backend directory, initialize your virtual environment, and install dependencies: Bash cd backend python -m venv venv source venv/bin/activate # On Windows: venv\Scripts\activate pip install google-genai fastapi uvicorn pydantic python-multipart Expose your Gemini API key to your environment variables: Bash # Linux/macOS export GEMINI_API_KEY="your_api_key_here" # Windows (Command Prompt) set GEMINI_API_KEY="your_api_key_here" # Windows (PowerShell) $env:GEMINI_API_KEY="your_api_key_here" Start the FastAPI server: Bash uvicorn main:app --reload --port 8000 The backend API documentation will be available locally at http://localhost:8000/docs. 2. Frontend Setup Open a new terminal window, navigate to the frontend directory, and install the dependencies: Bash cd frontend npm install Start the Vite development server: Bash npm run dev Open your browser and navigate to the local server URL provided by Vite (typically http://localhost:5173). 🛡️ Usage Save any raw log file (e.g., failed SSH attempts, web server access logs, or network scans) as a .txt or .log file. Click Ingest Raw Logs inside the dashboard web UI and upload the file. Click Analyze Telemetry to prompt the Gemini 2.5 Flash model. Review the extracted Attacker IP, Threat Severity level, chronological event reconstruction, and target mitigation scripts in real-time. 📝 Disclaimer This tool uses Generative AI to analyze logs and suggest security interventions. Always review and validate AI-generated remediation scripts in a controlled staging environment before deploying them directly to production network infrastructure. ```

标签：AI大模型, AV绕过, FastAPI, React, Syscalls, 安全运营, 库, 应急响应, 扫描框架, 自动化攻击, 逆向工具