• 

  Command Center — Demo incidents, security posture, assets, aur threat radar.

• 

  Threat Analyzer — Synthetic scenarios aur sanitized telemetry analysis.

• 

  Incident Response — Case queue, evidence, severity, aur analyst status.

• 

  Risk Intelligence — Explainable risk weights aur demo exceptions.

• 

  Safe Playbooks — Response steps dry-run simulation mein; live cloud actions unavailable hain.

• 

  Asset Inventory — Sample cloud assets, criticality, status, aur linked incidents.

• 

  Executive Report — Posture summary, defense metrics, aur threat vectors.

Inspiration

Security teams often have to make sense of alerts and logs from many different systems, while trying to distinguish urgent threats from background noise. We wanted to explore how one defensive security dashboard could help analysts connect those clues, understand why an alert matters, and decide what to investigate next.

What it does

AEGIS AI is a defensive security operations demo. It analyzes sample telemetry from sources such as AWS CloudTrail, identity providers, Kubernetes, CSV, and syslog. It can normalize and redact log data, correlate activity with detection rules and MITRE ATT&CK techniques, and calculate an explainable risk score.

Analysts can review incidents, explore assets and audit events, ask the Security Copilot for guidance, and run response playbooks in dry-run mode. The app uses Gemini when an API key is configured and has a local deterministic fallback for demos without a key.

How we built it

We built the interface with React and TypeScript, and the server with Node.js, Express, and TypeScript. A log normalization and sanitization layer prepares incoming data before the rule correlation and risk scoring engines analyze it. The Copilot can use Gemini for contextual analysis, with a local fallback available.

The interface brings together a command-center dashboard, threat analyzer, incident management, detection rules, asset inventory, audit log, executive report, and safe response playbooks.

Challenges we ran into

A major challenge was presenting AI analysis without making uncertain conclusions look like confirmed facts. We designed the analysis to separate observed evidence from AI-generated inferences and made the risk score explainable.

We also had to treat logs as untrusted input. The project includes secret redaction and prompt-safety measures, and it keeps response actions in dry-run mode because the demo has no live AWS execution integration.

Accomplishments that we're proud of

We’re proud that AEGIS AI brings log analysis, incident triage, risk scoring, and response planning into one working demo. The app can demonstrate its analysis flow with sample data even when no Gemini API key is configured.

We’re also proud that the demo makes its boundaries visible: its telemetry is synthetic, its playbooks simulate

Built With

• express.js
• google-gemini
• node.js
• react
• tailwind-css
• typescript
• vite