AI-SOC Sentinel

About AI-SOC Sentinel

Inspiration Cybersecurity teams often need to examine large amounts of network activity to identify suspicious behavior and investigate potential threats. For beginners and small organizations, understanding alerts and deciding which incidents need attention can be challenging. This inspired us to build AI-SOC Sentinel, an AI-assisted cybersecurity tool that helps users detect unusual network activity, prioritize potential risks, and understand security alerts more easily.

What It Does AI-SOC Sentinel analyzes network log data and highlights activity that may be unusual. It assigns risk scores to detected anomalies, provides preliminary MITRE ATT&CK-related context, and generates investigation explanations using an AI integration when available. Users can also record and review security incidents through a simple dashboard.

How We Built It I built the project using Python and Streamlit to create an interactive dashboard. Pandas and NumPy handle network log data, while Scikit-learn's Isolation Forest algorithm identifies unusual patterns in numerical network features. A rule-based risk engine assigns preliminary risk levels, and a MITRE ATT&CK mapping module provides relevant threat context. SQLite stores incident records, and an optional Gemini API integration helps generate readable investigation summaries. A fallback explanation is available when the AI service is not configured.

Challenges We Faced One challenge was combining multiple components—anomaly detection, risk scoring, threat context, AI explanations, and incident management—into one simple workflow. Another was presenting machine-learning results in a way that users can understand without requiring deep cybersecurity knowledge. I also considered API availability and designed a fallback explanation so that the basic investigation workflow can still be demonstrated without an API key.

What I Learned Through this project, I explored how machine learning can support cybersecurity investigations, how to build an interactive application with Streamlit, and how to connect AI-generated explanations with structured security data. We also learned that an anomaly is not automatically a confirmed attack: alerts require further investigation and validation.

Future Improvements Future versions could use larger, validated cybersecurity datasets, improve risk-scoring methods, integrate live threat-intelligence feeds, and evaluate detection performance using precision, recall, and false-positive rates. I also hope to add authentication and more advanced incident-response workflows.

AI-SOC Sentinel aims to make initial security investigation more accessible by bringing anomaly detection, risk prioritization, and understandable explanations into one lightweight dashboard.