MirageMind-AI

# 🛡️ MirageMind-AI

**AI-Powered Deception & Threat Intelligence Platform for Local Honeypot Analysis.**

MirageMind-AI is a completely free, open-source, and locally executed threat intelligence platform built for SOC analysts, threat hunters, and cybersecurity students. It ingests honeypot telemetry (JSON/CSV), performs deterministic risk scoring, extracts Indicators of Compromise (IOCs), maps observed attack behaviors directly to MITRE ATT&CK, and uses local LLMs via Ollama to generate comprehensive incident reports without cloud dependency or API fees.

---

## 📸 Platform Previews

| 📊 Threat Overview & Dashboard | 🧠 Local LLM Analyst Report |
| :---: | :---: |
| ![Dashboard Preview](screenshots/dashboard.png) | ![AI Analyst Report](screenshots/185IPreport.png) |

| 🛡️ MITRE ATT&CK Mapping | 🎯 IOC Extraction Explorer |
| :---: | :---: |
| ![ATT&CK Mapping](screenshots/ATT&CK_Mapping.png) | ![IOC Explorer](screenshots/IOC.png) |

---

## 🌟 Key Features

* **Local LLM Incident Reporting:** Generate full incident reports detailing attacker objectives, command breakdowns, NIST IR alignment, and defensive recommendations using local models (`llama3`, `mistral`, `qwen2.5:1.5b`) via Ollama.
* **MITRE ATT&CK Mapping:** Rule-based detection maps inbound honeypot commands to verified techniques (e.g., Ingress Tool Transfer `T1105`, Credential Dumping `T1003.008`).
* **Automated IOC Extraction:** Identifies and indexes URLs, target file paths, MD5/SHA256 hashes, and IPv4 addresses directly from attack streams.
* **Deterministic Risk Engine:** Transparent scoring model based on execution severity and service targeting.
* **Air-Gapped & Privacy-Focused:** Operates locally on SQLite and local LLM endpoints with zero external telemetry transmission.
* **Data Ingestion & Simulation:** Upload Cowrie/custom JSON logs or load built-in attack simulations with one click.
* **Multi-Format Export:** Export raw telemetry and IOC collections to CSV, and export AI incident reports to Markdown.

---

## 🛠️ Architecture & Tech Stack

* **Frontend & Visualization:** Streamlit, Plotly Express, Pandas
* **Local AI Inference Engine:** Ollama API (`localhost:11434`)
* **Database & Persistence:** SQLite3
* **Security Frameworks:** MITRE ATT&CK, NIST Incident Response Framework, CIS Controls

---

## 🚀 Installation & Setup (Windows 10 / VS Code)

### 1. Prerequisites
* **Python 3.11+** (Tested on Python 3.13 and Python 3.14)
* **Ollama for Windows** installed and running.

Pull your preferred local model via terminal or PowerShell:
```powershell
# For low-spec/CPU-only setups (Recommended for 8-12 GB RAM):
ollama pull qwen2.5:1.5b

# For standard setups:
ollama pull mistral

```

### 2. Clone & Environment Setup

Clone the repository:

```bash
git clone https://github.com/JuttSahib1999/MirageMind-AI.git
cd MirageMind-AI

```

Create and activate a virtual environment using your Python 3.13 installation:

```powershell
py -3.13 -m venv venv
.\venv\Scripts\activate

```

Install the required packages:

```powershell
pip install -r requirements.txt

```

### 3. Environment Configuration

Copy the configuration template:

```powershell
cp .env.example .env

```

### 4. Run the Platform

Launch the Streamlit application:

```powershell
streamlit run app.py

```

Open your browser and navigate to `http://localhost:8501`.

---

## 🧪 Testing with Sample Data

1. Open the **⚙️ Data & Settings** tab in the dashboard.
2. Click **Load Simulated Attack Data** to populate the local database with pre-configured multi-stage honeypot sessions.
3. Explore the **📊 Dashboard**, inspect parsed data under **🎯 IOC Explorer** and **🛡️ ATT&CK Mapping**, and run an analysis under **🧠 AI Analyst**.

---

## 👨‍💻 Author

* **Abdul Muqeet Tabraiz**
* **LinkedIn:** [Abdul Muqeet Tabraiz](https://www.linkedin.com/in/abdul-muqeet-tabraiz/)
* **GitHub:** [@JuttSahib1999](https://github.com/JuttSahib1999)

---

## 📄 License

This project is licensed under the **MIT License**. See the [LICENSE](https://www.google.com/search?q=LICENSE) file for details.
README.md
