NexusSOAR-AI

# NexusSOAR-AI 🛡️🤖

**NexusSOAR-AI** is a completely free, AI-powered Security Orchestration, Automation, and Response (SOAR) platform. It automates the tedious tasks of alert enrichment, investigation workflows, response actions, and incident reporting using Google Gemini.

> **Note:** This is Version 1 of the application and is considered complete. No future updates will be pushed to this repository.

---

## ✨ Features

* **Automated Ingestion:** Consumes SIEM/Webhook alerts via JSON.
* **Free OSINT Enrichment:** Automatically queries free threat intel/IP sources.
* **AI-Driven Investigation:** Analyzes payloads and enrichment data using Google Gemini to determine severity, summarize the threat, and map to MITRE ATT&CK.
* **Automated Response:** Takes programmatic action (e.g., firewall blocklist appending) based on AI verdicts.
* **Automated Reporting:** Generates clean Markdown incident reports for every processed alert.

---

## 🚀 Setup on Windows 10 (VS Code)

1. **Clone the repository** and open it in VS Code.
2. **Open the terminal** and create a virtual environment explicitly with Python 3.13:
```bash
py -3.13 -m venv venv
# (Or use 'py -3.13 -m venv venv' depending on your preference)

```


3. **Activate the environment:**
```bash
.\venv\Scripts\activate

```


4. **Install dependencies:**
```bash
pip install -r requirements.txt

```


5. **Configure your API key:**
Copy `.env.example` to `.env` and add your free Google Gemini API key.
6. **Run the engine:**
```bash
python main.py

```



---

## 👨‍💻 Author

Created by **Abdul Muqeet Tabraiz**

* **LinkedIn:** [Abdul Muqeet Tabraiz](https://www.linkedin.com/in/abdul-muqeet-tabraiz/)
* **GitHub:** [JuttSahib1999](https://github.com/JuttSahib1999)

---

## 📄 License

This project is licensed under the MIT License - see the `LICENSE` file for details.