ai-security-log-analyzer

# AI Security Log Analyzer 🛡️

[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
[![Python 3.8+](https://img.shields.io/badge/python-3.8+-blue.svg)](https://www.python.org/downloads/)
[![Ollama](https://img.shields.io/badge/Ollama-LLM-green.svg)](https://ollama.ai/)

**Author:** Abdul Muqeet Tabraiz  
**LinkedIn:** [Connect with me](https://www.linkedin.com/in/abdul-muqeet-tabraiz/)  
**GitHub:** [@JuttSahib1999](https://github.com/JuttSahib1999)

## 🚀 Overview

AI Security Log Analyzer is a comprehensive security analysis tool that ingests Windows Event Logs and Linux authentication logs, detects suspicious activities using both rule-based detection and local LLM (Ollama Llama/Mistral), and generates actionable security incident reports with MITRE ATT&CK mappings.

## ✨ Features

- **Multi-platform Log Ingestion**: Windows Event Logs (EVTX) and Linux authentication logs
- **Dual Detection Engine**: Rule-based + AI-powered detection using local LLM
- **MITRE ATT&CK Mapping**: Automatic mapping of detected threats to MITRE framework
- **Severity Classification**: Automated severity scoring (Critical, High, Medium, Low, Info)
- **Incident Summaries**: Human-readable incident reports with recommended actions
- **Dual Interface**: CLI tool + Web Dashboard
- **Zero Cost**: Completely free, no API keys required
- **Privacy-First**: All processing happens locally

## 📋 Prerequisites

- Python 3.8 or higher
- Ollama installed locally with Llama 2 or Mistral models
- For Windows: Python-evtx library
- For Linux: Standard syslog access

## 🔧 Installation

### 1. Clone the Repository
```bash
git clone https://github.com/JuttSahib1999/ai-security-log-analyzer.git
cd ai-security-log-analyzer

```

### 2. Install Dependencies

```bash
pip install -r requirements.txt

```

### 3. Install and Configure Ollama

```bash
# Install Ollama (Linux/macOS)
curl -fsSL https://ollama.ai/install.sh | sh

# Pull a model (Llama 2 or Mistral)
ollama pull llama2
# or
ollama pull mistral

```

### 4. Configure the Tool

```bash
cp config/settings.example.py config/settings.py
# Edit config/settings.py with your preferences

```

## 🎮 Usage

### Command Line Interface

#### Analyze a Windows Event Log

```bash
python -m src.cli analyze --source windows --file path/to/eventlog.evtx --output report.json

```

#### Analyze Linux Authentication Logs

```bash
python -m src.cli analyze --source linux --file /var/log/auth.log --output report.json

```

#### Real-time Monitoring

```bash
python -m src.cli monitor --source linux --interval 60

```

### Web Dashboard

```bash
python -m src.web_app

```

Access the dashboard at: `http://localhost:5000`

### Docker Deployment

```bash
docker-compose up -d

```

## 📊 Output Example

```json
{
  "incident": {
    "id": "INC-2026-001",
    "timestamp": "2026-07-02T14:32:18Z",
    "severity": "HIGH",
    "source": "Windows",
    "category": "Privilege Escalation",
    "description": "Multiple failed logon attempts followed by successful admin login",
    "mitre_mappings": [
      "TA0004 - Privilege Escalation",
      "T1078 - Valid Accounts",
      "T1110 - Brute Force"
    ],
    "recommended_actions": [
      "Reset affected user credentials immediately",
      "Enable MFA for administrative accounts",
      "Review user permissions",
      "Check for lateral movement attempts"
    ],
    "detection_source": "Rule-based + LLM"
  }
}

```

## 🏗️ Architecture

```text
┌─────────────────────────────────────────────────────────────┐
│                    User Interface Layer                     │
│           ┌──────────────┐      ┌──────────────┐            │
│           │   CLI Tool   │      │ Web Dashboard│            │
│           └──────────────┘      └──────────────┘            │
└─────────────────────────────────────────────────────────────┘
                             │
┌─────────────────────────────────────────────────────────────┐
│                    Core Analysis Engine                     │
│   ┌─────────────────┐   ┌─────────────────┐   ┌────────────┐│
│   │ Rule-Based      │   │   LLM-Based     │   │  Combined  ││
│   │ Analyzer        │   │   Analyzer      │   │  Analyzer  ││
│   └─────────────────┘   └─────────────────┘   └────────────┘│
└─────────────────────────────────────────────────────────────┘
                             │
┌─────────────────────────────────────────────────────────────┐
│                      Log Ingestors                          │
│   ┌─────────────────┐   ┌─────────────────┐                 │
│   │  Windows EVTX   │   │ Linux Auth Log  │                 │
│   │    Ingestor     │   │    Ingestor     │                 │
│   └─────────────────┘   └─────────────────┘                 │
└─────────────────────────────────────────────────────────────┘

```

## 🧪 Testing

```bash
pytest tests/

```

## 📝 Configuration

Edit `config/settings.py` to customize:

* Detection thresholds
* Severity levels
* MITRE framework mapping
* LLM model selection
* Log retention policies

## 🤝 Contributing

1. Fork the repository
2. Create your feature branch (`git checkout -b feature/AmazingFeature`)
3. Commit your changes (`git commit -m 'Add some AmazingFeature'`)
4. Push to the branch (`git push origin feature/AmazingFeature`)
5. Open a Pull Request

## 📄 License

Distributed under the MIT License. See LICENSE for more information.

## ⭐ Support

If you find this project useful, please give it a ⭐ on GitHub!

## 🔒 Security Considerations

* All processing occurs locally - no data sent to external services
* Log data is stored securely with encryption
* Access controls implemented for web dashboard
* Regular security updates and patches

## 📞 Contact

**Abdul Muqeet Tabraiz**

* LinkedIn: [AbdulMuqeetTabraiz](https://www.linkedin.com/in/abdul-muqeet-tabraiz/)
* GitHub: [JuttSahib1999](https://github.com/JuttSahib1999)

## 🙏 Acknowledgments

* MITRE Corporation for the ATT&CK framework
* Ollama team for the excellent local LLM platform
* Python community for the amazing libraries