Chronicle — AI Incident Storyteller

Turns raw security logs into a plain-language incident story and MITRE ATT&CK timeline — no API keys required.

Comment

Inspiration

As a cybersecurity student, I spend a lot of time in SOC and detection engineering coursework — analyzing Sysmon events, Windows Security logs, and forensic artifacts. One thing became clear fast: raw logs are technical and disconnected. A list of timestamps, event IDs, and process names doesn't mean much to anyone outside the SOC — but that's exactly what analysts have to turn into a clear incident report after every case.

I was also mid-way through my own internship capstone project — simulating and detecting Brute Force and Pass-the-Hash attacks against a Windows Server Domain Controller — and kept thinking: what if the connection between "here's what the logs show" and "here's what actually happened" could be automated? That question became Chronicle.

What it does

Chronicle takes raw, technical log or forensic entries — pasted in as free text, one event per line — and reconstructs them into:

  • plain-language incident narrative, written as flowing prose instead of a log dump
  • MITRE ATT&CK-mapped timeline, classifying each event against a known technique
  • kill-chain progress rail, showing the attack's path from Reconnaissance through to Exfiltration
  • Automatic detection of timestamps and IP addresses , with zero fixed schema required

It works fully offline — no external AI API, no API keys, no cloud dependency — which also makes it reliable for demos and safe to use with sensitive log data.

How I built it

The backend is a Python/Flask app built around a custom rule-based NLP engine (timeline_engine.py). Each log line is:

  1. Parsed— timestamps and IPs are extracted with regex, with no assumptions about log format
  2. Classified — matched against a weighted keyword library spanning 11 MITRE ATT&CK techniques across the kill chain (Reconnaissance, Initial Access, Credential Access, Lateral Movement, Persistence, Exfiltration, and more)
  3. Narrated — the highest-confidence match is rewritten into a natural-language sentence using a narrative template, then chained with the other events into one coherent story
  4. Visualized — the observed techniques are placed along the canonical kill-chain order to build the progress rail and timeline

The frontend is a three-page Flask app (an overview/landing page, a "how it works" page walking through the pipeline, and the working tool) styled as a dark, SOC-console-inspired interface, with scroll-reveal animations, a typewriter effect for the generated narrative, and a staggered "light-up" animation for the kill-chain rail.

The knowledge base — which techniques map to which MITRE IDs, Sysmon event sources, and narrative language — was informed directly by my own hands-on Active Directory attack simulation work (Brute Force and Pass-the-Hash detection on a Windows Server / Kali lab setup).

Challenges I ran into

  • Keeping it genuinely offline without losing "AI" value. Rather than wrapping an LLM API, I built a weighted keyword-scoring engine so the tool works with zero setup and zero API cost — while still needing careful tuning (keyword weighting, confidence scoring) to avoid false positives on ambiguous log text.
  • Making a story out of disconnected lines. Turning independent classified events into a narrative that reads like one continuous incident, rather than a list of unrelated sentences, took a few iterations of the narrative template design.
  • Balancing technical accuracy with readability. The tool needed to stay accurate to real Sysmon/Windows event sources and MITRE technique IDs (so it's actually useful to a SOC analyst) while still being readable to someone without a security background.

What I learned

Building the technique-to-narrative mapping deepened my own understanding of how kill-chain stages connect in a real attack — reconnaissance leading into credential access, into lateral movement, into persistence — which directly reinforced concepts from my own detection engineering coursework and capstone project. I also got hands-on practice designing a multi-page Flask application with a cohesive design system, rather than a single-page tool.

What's next for Chronicle

  • Expanding the technique library toward full MITRE ATT&CK Enterprise coverage
  • Exporting the reconstructed narrative and timeline as a downloadable PDF incident report
  • Accepting raw Sysmon/Wazuh JSON or EVTX exports directly, instead of manually pasted text
  • An optional LLM-backed mode for richer, freer natural-language narrative generation

Built With

Share this project:

Updates

Submission history