NIST-AI-IR-Assistant

# NIST AI Incident Response Assistant 🛡️

An AI-powered Incident Response Assistant designed to ingest security alerts and guide SOC analysts through the **NIST SP 800-61 Rev. 2 Incident Response Lifecycle**. Utilizing Google's `gemini-3.6-flash` model, this tool generates actionable, context-aware playbooks for Detection, Containment, Eradication, and Recovery phases.

---

## 🌟 Features

* **NIST Framework Alignment:** Generates technical guidance mapped directly to standard IR phases.
* **Lightning Fast AI:** Powered by the highly capable `gemini-3.6-flash` model.
* **Context Aware:** Adjusts playbooks based on business impact, incident type, and raw log data.
* **Free & Open Source:** Version 1.0.0 is entirely free to run locally using your own API key.

---

## 🖼️ Screenshots

![NIST AI Incident Response Assistant - Main Interface](screenshots/main_interface.png)

---

## 🚀 Installation & Usage (Windows)

1. **Clone the repository:**
```bash
git clone https://github.com/JuttSahib1999/NIST-AI-IR-Assistant.git
cd NIST-AI-IR-Assistant

```


2. **Create and activate a virtual environment:**
```bash
py -3.14 -m venv venv  # (Or use 'py -3.13 -m venv venv' depending on your preference)
.\venv\Scripts\activate

```


3. **Install dependencies:**
```bash
pip install -r requirements.txt

```


4. **Set up your API key:**
Create a `.env` file in the root directory and add:
```env
GEMINI_API_KEY="your_google_api_key_here"

```


5. **Run the application:**
```bash
streamlit run app.py

```



---

## 👨‍💻 Author

Created by **Abdul Muqeet Tabraiz**

* **LinkedIn:** [Abdul Muqeet Tabraiz](https://www.linkedin.com/in/abdul-muqeet-tabraiz/)
* **GitHub:** [JuttSahib1999](https://github.com/JuttSahib1999)

---

## 📄 License

This project is licensed under the MIT License - see the `LICENSE` file for details.