Back to Projects

SentryMind-AI

A fully local AI cybersecurity assistant powered by RAG, Ollama, and ChromaDB to analyze MITRE ATT&CK, NIST frameworks, and incident reports offline.

chromadbcybersecurityincident-responselangchainlocal-aimitre-attacknist-frameworkollamapythonragstreamlit
0
Stars
0
Forks
0
Watchers
0
Open Issues

README.md

# SentryMind-AI

A fully local AI cybersecurity assistant powered by Retrieval-Augmented Generation (RAG). It ingests security documentation, incident reports, and MITRE ATT&CK datasets to provide context-aware analytical support with strict document source citations.

---

## ✨ Features

* **100% Local Execution:** No data leaves your environment. Models run offline via Ollama.
* **Dynamic Multi-Source Ingestion:** Automatically parses and vectorizes PDF and plain-text incident reports, frameworks, and CTI matrices.
* **Source-Referenced Intelligence:** Appends exact local document paths to every analytical response for complete auditability.
* **Modern LCEL Architecture:** Built using LangChain Expression Language (LCEL) and ChromaDB for local vector retrieval.

---

## Screenshots

### 1. MITRE ATT&CK TTP & Mitigation Analysis
Querying Credential Access techniques and obtaining exact CIS Control mitigations alongside verified source citations:

![MITRE ATT&CK Analysis](screenshots/MITRE%20ATT%26CK.png)

### 2. Incident Handling & Framework Queries
Querying the NIST SP 800-61 Rev. 2 incident response framework for containment, eradication, and recovery phases:

![NIST IR Framework Query](screenshots/NIST%20IR%20Framework.png)

---

## 🚀 Getting Started

### Prerequisites

* Python 3.13
* [Ollama for Windows](https://ollama.com/download/windows)

### 1. Setup Ollama Model

Pull the local LLM using your command terminal:

```bash
ollama run llama3

```

### 2. Environment Setup

Create and activate your Python environment:

```bash
# Create a new virtual environment explicitly with Python 3.13
# (Or use 'py -3.13 -m venv venv' depending on your preference)
py -3.13 -m venv venv
.\venv\Scripts\activate
pip install -r requirements.txt

```

### 3. Ingest Data & Run Application

Place your security documents inside `data/` subdirectories, populate the local vector store, and launch the dashboard:

```bash
python ingest.py
streamlit run app.py --server.fileWatcherType none

```

---

## 👨‍💻 Author

Created by **Abdul Muqeet Tabraiz**

* **LinkedIn Profile:** [Abdul Muqeet Tabraiz](https://www.linkedin.com/in/abdul-muqeet-tabraiz/)
* **GitHub Profile:** [JuttSahib1999](https://github.com/JuttSahib1999)

---

## 📄 License

This project is licensed under the MIT License - see the LICENSE file for details.