Back to Projects
ThreatForge-AI
An AI-powered purple teaming assistant that generates lab attack simulations, defensive mitigations, and detection rules across Wazuh SIEM, Splunk SPL, Sentinel KQL, and Sigma.
attack-simulationcybersecuritydetection-engineeringgenerative-aimicrosoft-sentinelmitre-attackpurple-teampythonsiemsigma-rulessplunkwazuh
0
Stars
0
Forks
0
Watchers
0
Open Issues
README.md
# ThreatForge-AI 🛡️
**ThreatForge-AI** is a completely free, AI-powered cybersecurity tool designed to bridge the gap between offensive simulations and defensive detection engineering. By inputting a MITRE ATT&CK technique or a general attack description, the system automatically generates safe lab simulation commands alongside detection logic in Splunk SPL, Microsoft Sentinel KQL, Wazuh XML rules, and Sigma formats.
This is **Version 1.0** (Final Release).
---
## 📸 Application Interface & Output Preview
### 1. Main User Interface
### 2. Attack Simulation & Multi-SIEM Detections (Example: T1003)
---
## ✨ Features
* **Red Team Simulations:** Generates safe, executable command-line arguments to simulate attacks in test environments.
* **Blue Team Detections:** Automatically creates Splunk SPL, Sentinel KQL, Wazuh XML rules, and Sigma rule formats.
* **Mitigation Strategies:** Provides actionable defense recommendations and hardening guidelines.
* **Web Interface:** Built on Streamlit for a clean, user-friendly local web UI.
---
## ⚙️ Prerequisites
* Windows 10
* Visual Studio Code
* Python 3.13 (or compatible version)
* A free Google Gemini API Key from [Google AI Studio](https://aistudio.google.com/)
---
## 🚀 Setup and Installation
1. Clone the repository and open the folder in Visual Studio Code.
2. Open a new terminal in VS Code (`Terminal` -> `New Terminal`).
3. Create and activate a virtual environment explicitly with Python 3.13:
```bash
py -3.13 -m venv venv
# (Or use 'py -3.13 -m venv venv' depending on your preference)
.\venv\Scripts\activate
```
4. Install the required dependencies:
```bash
pip install -r requirements.txt
```
5. Rename `.env.example` to `.env` and add your API key:
```env
GEMINI_API_KEY="your_actual_api_key_here"
```
---
## 💻 Usage
Run the application using Streamlit:
```bash
streamlit run app.py
```
A new browser window will open automatically. Enter a MITRE ID (e.g., `T1003`) or technique name to generate the simulation and multi-SIEM detection data.
---
## 👨💻 About the Author
Created by **Abdul Muqeet Tabraiz**
* **LinkedIn:** [Abdul Muqeet Tabraiz](https://www.linkedin.com/in/abdul-muqeet-tabraiz/)
* **GitHub:** [JuttSahib1999](https://github.com/JuttSahib1999)
---
## 📄 License
This project is licensed under the MIT License - see the LICENSE file for details.