Back to Projects
AI-IOC-Investigator-v1
An open-source, AI-powered Threat Intelligence tool that automatically investigates IPs, Domains, URLs, and Hashes using free OSINT APIs (VirusTotal, AlienVault OTX, AbuseIPDB) and generates comprehensive security analysis reports via Large Language Models.
0
Stars
0
Forks
0
Watchers
0
Open Issues
README.md
# 🛡️ AI-Powered IOC Investigation Tool (v1.0.0)
An open-source, fully automated threat intelligence tool designed for Security Operations Center (SOC) analysts and incident responders. This tool accepts Indicators of Compromise (IPs, Domains, URLs, and File Hashes), queries multiple free OSINT APIs simultaneously, and leverages the power of Artificial Intelligence to synthesize the raw data into a professional, human-readable security report.
---
## 🌟 Features
* **Multi-IOC Support:** Automatically detects and processes IPv4 addresses, Domains, URLs, and Hashes (MD5, SHA-1, SHA-256).
* **Aggregated OSINT:** Integrates seamlessly with the free tiers of:
* VirusTotal
* AlienVault OTX
* AbuseIPDB
* **AI-Generated Reports:** Utilizes the Google Gemini AI engine to write executive summaries, threat analyses, potential impact assessments, and remediation steps.
* **Modern UI:** Built on Streamlit for a fast, intuitive web interface.
---
## 📸 Screenshots
| Main Dashboard Interface | Malicious Domain Investigation Report |
| :---: | :---: |
|  |  |
*(Note: Additional investigation screenshots for IPs, hashes, and threat vectors are available in the `screenshots/` folder).*
---
## 🚀 Setup & Installation (Windows 10 / Cross-Platform)
1. **Clone the repository:**
```bash
git clone https://github.com/JuttSahib1999/AI-IOC-Investigator-v1.git
cd AI-IOC-Investigator-v1
```
2. **Create a Virtual Environment:**
```bash
python -m venv venv
venv\Scripts\activate
```
3. **Install Dependencies:**
```bash
pip install -r requirements.txt
```
4. **Environment Variables:**
Rename `.env.example` to `.env` and insert your free API keys:
```env
GEMINI_API_KEY=your_key
ALIENVAULT_API_KEY=your_key
VIRUSTOTAL_API_KEY=your_key
ABUSEIPDB_API_KEY=your_key
```
5. **Run the Application:**
```bash
streamlit run app.py
```
---
## 👤 Author
Created by **Abdul Muqeet Tabraiz**
* **LinkedIn:** [Abdul Muqeet Tabraiz](https://www.linkedin.com/in/abdul-muqeet-tabraiz/)
* **GitHub:** [JuttSahib1999](https://github.com/JuttSahib1999)
---
## 📄 License & Notes
This project is licensed under the MIT License - see the `LICENSE` file for details.
> **Note:** This is version 1.0.0, designed as a complete, static release.