AstraGrid

• 

  Landing page

• 

  Astragrid as layers

• 

  how Astragid Flows

• 

  what AstraGrid does

• 

  proof of evidence

Inspiration

Critical-infrastructure incidents now move faster than human triage. A water anomaly, power disruption, endpoint compromise, or network signal can appear isolated, but the real impact may cascade across sectors.

I chose this problem because most cyber tools stop at the digital artifact, but critical infrastructure incidents do not stop there. In power grids, water utilities, SCADA networks, and industrial systems, one wrong conclusion can become a wrong response. A water anomaly may look like a direct water cyberattack, but the real cause may be upstream power disruption, dependency failure, network activity, endpoint compromise, or missing context.

SANS SIFT already gives responders a powerful forensic workstation with trusted DFIR tools in one investigation environment. AstraGrid was inspired by the idea of extending that trusted environment into cyber-physical reasoning: not replacing the analyst, not replacing SIFT, but helping Protocol SIFT reason across infrastructure evidence before the first visible symptom becomes the wrong conclusion.

AstraGrid focuses on one core problem: in critical infrastructure response, the first hypothesis is often wrong. The system must validate context before it promotes a claim.

What it does

AstraGrid extends the SANS SIFT Workstation and Protocol SIFT with a structured cyber-physical reasoning layer.

It checks power, water, network, endpoint, dependency, and context-integrity evidence in sequence. It validates each claim as CONFIRMED, PARTIALLY_CONFIRMED, INFERRED, UNSUPPORTED, or CONTRADICTED.

When evidence does not support the first hypothesis, AstraGrid self-corrects. It produces a timeline, validated claims, self-correction trace, final report, accuracy report, response plan, context integrity report, and auditable tool-run logs.

AstraGrid does not replace SANS SIFT. It enhances SIFT by adding evidence sequencing, dependency reasoning, context integrity, claim validation, self-correction, and safe autonomous response planning on top of the forensic workstation.

The key rule is simple:

No direct attack or cascade claim is promoted without validated infrastructure context.

How we built it

• Built AstraGrid as a Python-based investigation engine designed to run inside the SANS SIFT case environment.

• Designed the workflow so investigation outputs can be generated and reviewed inside the forensic workstation, not only in a standalone web dashboard.

• Created structured tools for cyber-physical evidence layers:

  • Power-grid telemetry evidence
  • Water-treatment evidence
  • Water-distribution evidence
  • Modbus / ICS network evidence
  • Endpoint forensic evidence
  • Infrastructure dependency graphs
  • Context integrity validation

• Used normalized demo data and references from:

  • Power-grid telemetry
  • SWaT
  • BATADAL
  • WADI optional water-distribution adapter
  • Modbus / network traffic
  • Mordor endpoint evidence
  • MITRE ATT&CK context

• Added a Context Integrity layer that checks whether sensor context, actuator context, timestamp context, dependency context, and direct command-path support are strong enough before promoting cyber-physical claims.

• Added WADI as an optional large-scale water-distribution adapter to strengthen water-distribution context without falsely claiming it proves a direct water cyberattack.

• Built deterministic outputs for findings, timelines, claims, self-correction traces, final reports, accuracy reports, response plans, context integrity reports, and tool-run logs.

• Added a FastAPI layer to expose investigation outputs to the frontend dashboard.

• Verified the proof by running AstraGrid inside the SANS SIFT VM.

Challenges we ran into

The hardest challenge was avoiding overclaiming. A water anomaly can look like a direct water cyberattack, but the available evidence may only support a cascade hypothesis. AstraGrid had to mark unsupported claims clearly instead of presenting them as facts.

The second challenge was context. In cyber-physical systems, raw data is not enough. If sensor mapping, actuator mapping, timestamp context, asset dependency, or command-path context is wrong, the whole conclusion can collapse. That is why we added Context Integrity as a separate layer.

Another challenge was aligning a web-product demo with the actual hackathon goal. The frontend explains the investigation, but the real proof comes from SANS SIFT / Protocol SIFT execution, tool logs, evidence references, context validation, and claim validation.

We also had to keep the system deterministic. AstraGrid could not behave like a generic chatbot. It needed traceable tool outputs, evidence references, context boundaries, claim statuses, and audit-ready reports.

Accomplishments that we're proud of

• Successfully ran AstraGrid inside the SANS SIFT VM.

• Generated a complete cyber-physical investigation package.

• Started with the hypothesis: “Direct water cyberattack.”

• Checked evidence across power, water, network, endpoint, dependency, and context-integrity layers.

• Self-corrected the conclusion to: “Power-to-water cascade is plausible; direct water attack is unsupported.”

• Added Context Integrity with a STRONG status for the demo case.

• Added WADI as an optional large-scale water-distribution adapter.

• Generated:

  • 5 findings
  • 6 timeline events
  • 6 claims
  • 6 self-correction steps
  • Final report
  • Accuracy report
  • Response plan
  • Context integrity report
  • Auditable tool-run logs

• Achieved an accuracy report score of 1.0 against the demo ground truth.

• Avoided hallucinated country attribution.

• Avoided unsupported attacker claims.

• Kept direct water cyberattack UNSUPPORTED because no direct PLC / SCADA command path was proven.

• Kept destructive response actions behind human approval boundaries.

• Demonstrated evidence-backed reasoning instead of jumping to the first hypothesis.

What we learned

We learned that cyber-physical incident response needs more than alerts. It needs evidence sequencing, dependency reasoning, context validation, and disciplined claim validation.

We also learned that negative evidence matters. In our demo, water evidence existed, but the water tool did not prove a direct PLC or water command path. That negative result became the key reason for rejecting the direct-water-attack hypothesis.

Most importantly, we learned that context integrity is the safety layer for cyber-physical AI response. Larger datasets like WADI are valuable, but bigger data does not automatically mean stronger causality. Sensor, actuator, timestamp, dependency, and command-path context must be validated before the system promotes a claim.

Protocol SIFT can become more powerful when domain-specific tools help the AI responder reason like a senior analyst instead of only summarizing artifacts.

What's next for AstraGrid

Next, we plan to expand AstraGrid with deeper WADI-based water-distribution scenarios, full MCP server registration, and stronger Protocol SIFT tool discovery.

We also plan to add multi-case cascade reasoning, live SCADA and OT telemetry ingestion, deeper MITRE ATT&CK for ICS mapping, and more infrastructure layers such as telecom, healthcare, transportation, and industrial plants.

The long-term goal is to make AstraGrid a cyber-physical reasoning layer for SANS SIFT: one that helps AI responders investigate faster, validate context earlier, self-correct before the wrong conclusion becomes the record, recommend safe response actions, and produce audit-ready reports without unsupported attribution.

Built With

• batadal
• cic-modbus-dataset
• claude-code
• css
• fastapi
• javascript
• json
• mcp-ready-tools
• mitre-att&ck
• mordor-endpoint-evidence
• netlify
• protocol-sift
• python
• react
• sans-sift-workstation
• swat
• uvicorn
• wadi