CrowdShield AI

CrowdShield AI is a real-time EDR pipeline. It ingests host logs, correlates events using sliding windows and local rules, scores threat chains with LLMs, and alerts Kafka for automated response.

Comment

Why We Built CrowdShield AI

Hi! I'm a software developer working at a startup.

Like many development teams today, we use npm packages, VS Code extensions, browser plugins, and AI coding agents every single day. They help us build products much faster, but they also require access to our project files and environment variables.

During development, we realized how risky this actually is. Imagine installing what looks like a normal package, only to find out later that it has been compromised. Within seconds, it can access your .env file, API keys, cloud credentials, and even your source code. By the time you notice something is wrong, the damage may already be done.

What surprised us even more was that traditional antivirus software and corporate proxies often don't detect these attacks because the malicious activity comes from trusted applications like Node.js, Chrome, or VS Code.

When we started researching further, we found that this wasn't an isolated problem. Some recent examples include:

These are just a few examples. New supply chain attacks are being discovered regularly, making this one of the biggest security challenges for modern software teams.

This question came to our mind:

What if we could detect when a trusted package starts stealing sensitive data?

That question became the idea behind CrowdShield AI.

We built CrowdShield AI to monitor developer machines in real time, detect suspicious package behavior, investigate it using AI, and automatically alert or respond before sensitive credentials and source code leave the system.

This hackathon gave us the opportunity to turn that idea into a working prototype, and that's what we're excited to share.

What CrowdShield AI Does

CrowdShield AI is an AI-powered endpoint security platform built to protect developers from modern software supply chain attacks.

It combines Splunk Enterprise, (Sysmon + Splunk Universal Forwarder), Apache Kafka, and AI agents to continuously monitor developer machines in real time. Whether the activity comes from an npm package, a VS Code extension, a browser plugin, or an AI coding agent, CrowdShield AI watches for suspicious behavior.

If a trusted application starts accessing .env files, API keys, credentials, or making unexpected network connections, CrowdShield AI detects the behavior, investigates it using AI, correlates related events, and instantly notifies the user.

Our goal is simple: help developers and security teams protect their credentials, source code, and sensitive files from modern supply chain attacks.

How We Built It

We designed CrowdShield AI around two core components: a real-time ingestion pipeline and an interactive security dashboard.

Real-Time Ingestion Pipeline

The ingestion pipeline continuously collects endpoint telemetry from Sysmon through Splunk Enterprise. Instead of processing every event individually, we correlate related activities over a rolling time window to understand the complete behavior of a process.

For example, if a Node.js process reads a .env file and then immediately opens an external network connection, CrowdShield AI links those events together instead of treating them as isolated actions.

To keep detection both fast and accurate, we use a hybrid approach:

  • Rule-based detection quickly identifies known attack patterns with minimal latency.
  • AI-powered analysis investigates more complex or previously unseen behaviors that traditional rules may miss.

If a high-confidence threat is detected, the alert is immediately published to Apache Kafka, allowing the response pipeline to start within seconds.

Interactive Security Dashboard

To make threat monitoring simple and intuitive, we built a real-time dashboard using CustomTkinter.

The dashboard displays live security events, visualizes the execution of our AI agents, and provides instant desktop notifications whenever a high-risk threat is detected.

Because monitoring, AI analysis, and Kafka consumption all run in background threads, the interface remains responsive while continuously processing live endpoint telemetry.

This architecture allows CrowdShield AI to detect, investigate, and visualize supply chain attacks in real time without interrupting the user's workflow.

System Architecture

Project System Architecture

CrowdShield AI follows a five-layer architecture that transforms raw endpoint telemetry into AI-driven threat detection and automated response.

Layer 1 – Endpoint Telemetry

Everything starts on the developer's machine.

We use Sysmon to monitor endpoint activities such as process creation, file access, network connections, and file deletion events. A custom Sysmon configuration focuses on sensitive files like .env, SSH keys, and other developer assets.

The collected telemetry is forwarded to Splunk Enterprise using the Splunk Universal Forwarder, giving us a centralized source of endpoint events.

Layer 2 – SIEM & Correlation Pipeline

Once the events reach Splunk, our ingestion pipeline continuously polls only the latest telemetry.

Instead of analyzing every event individually, we store related events inside a PID Correlation Buffer using a rolling time window. This allows CrowdShield AI to understand complete attack sequences instead of isolated events.

For example:

  • A Node.js process reads a .env file.
  • The same process immediately opens an external network connection.
  • Both events are correlated into a single suspicious activity.

The correlated events are then analyzed using both rule-based detection and AI-powered threat scoring to determine their severity.

Layer 3 – Kafka Event Streaming

After threat scoring, alerts are published into Apache Kafka.

Kafka acts as the messaging backbone of the system and separates detection from investigation.

Events are categorized into:

  • High Priority
  • Medium Priority
  • Low Priority

Only medium and high-priority threats continue through the AI investigation pipeline, reducing unnecessary processing and keeping AI inference costs low.

Layer 4 – AI Control Plane

High-priority events are processed by our LangGraph multi-agent workflow.

The workflow consists of three specialized AI agents:

  • Detection Agent – Evaluates the attack and assigns a risk score.
  • Investigation Agent – Queries the Splunk MCP Server to collect historical logs and additional evidence.
  • Response Agent – Determines the most appropriate response, such as notifying the user or terminating a malicious process.

By separating responsibilities across multiple agents, CrowdShield AI produces faster and more reliable security decisions.

Layer 5 – Security Response & Dashboard

The final layer focuses on helping developers understand and respond to threats.

The dashboard provides:

  • Live threat monitoring
  • Real-time security alerts
  • AI-generated investigation summaries
  • Process termination for malicious applications
  • Desktop notifications for high-risk incidents

Instead of only reporting an alert, CrowdShield AI explains what happened, why it happened, and what action should be taken, enabling developers to respond within seconds.

This layered architecture combines Sysmon, Splunk Enterprise, Apache Kafka, LangGraph, and Splunk MCP into a complete end-to-end security platform for detecting and responding to modern software supply chain attacks.

Design & Software Engineering Excellence

We wanted CrowdShield AI to be more than just a security tool we wanted it to be something developers and security teams could actually use every day.

Modern Security Dashboard

The application features a clean, dark-themed dashboard built with CustomTkinter that displays security events in real time. As new threats are detected, alerts appear instantly, AI agents are visualized as they execute, and desktop notifications provide immediate feedback to the user.

Instead of overwhelming users with raw logs, the dashboard explains what happened, why it happened, and what action should be taken.

Responsive User Experience

Security monitoring runs continuously in the background without affecting the user experience.

Splunk polling, Kafka consumers, AI inference, and live event updates all execute on background threads, ensuring the interface remains smooth and responsive even while processing thousands of events.

Clean Software Architecture

CrowdShield AI follows the Model–View–Controller (MVC) architecture, making the project modular and easy to maintain.

  • Model – Collects endpoint telemetry, processes events, and manages external integrations.
  • View – Displays the dashboard, live threat feed, AI workflow, and notifications.
  • Controller – Coordinates Kafka events, AI agents, and automated response actions.

This separation allows each component to evolve independently while keeping the codebase organized and scalable.

Built for Scalability

The platform is designed using an event-driven architecture powered by Apache Kafka, allowing telemetry collection, AI investigation, and user notifications to operate independently. This makes CrowdShield AI easier to extend with additional AI agents, detection rules, or enterprise integrations in the future.

Overall, our focus was to build a platform that is not only technically robust but also intuitive, responsive, and practical for real-world security operations.

Potential Impact & What We're Proud Of

As we mentioned earlier, software supply chain attacks are becoming more common, and many startups and large tech companies have already been affected. A single compromised package, browser extension, or AI tool can expose API keys, .env files, credentials, and even source code before anyone realizes what's happening.

That's why we built CrowdShield AI. Instead of only trusting that an application is safe, our platform continuously monitors what trusted applications are actually doing. If a package or extension suddenly starts accessing sensitive files or making suspicious network connections, CrowdShield AI detects the behavior, investigates it using AI, and immediately notifies the user so action can be taken before data is stolen.

During this hackathon, we're proud to have:

  • Built a real-time endpoint monitoring pipeline using Sysmon and Splunk Enterprise.
  • Designed a scalable event-driven architecture with Apache Kafka.
  • Developed a multi-agent AI workflow for detection, investigation, and response using LangGraph.
  • Integrated Splunk MCP to provide historical security context for AI-driven investigations.
  • Built a responsive desktop dashboard with live alerts and AI-powered threat analysis.
  • Combined rule-based detection with AI reasoning to achieve both fast response and intelligent analysis.

We believe CrowdShield AI can help startups and enterprises better defend against modern software supply chain attacks by giving security teams visibility into threats that traditional antivirus and corporate proxies often miss.

Challenges We Ran Into & What We Learned

One of the biggest challenges was latency. In cybersecurity, every second matters. From the moment a suspicious event occurs to the AI making a decision, there can be delays caused by telemetry collection, network communication, and LLM inference. We learned that building an AI-powered security system isn't just about making accurate decisions it's also about making them fast enough to stop an attack before data is stolen.

To address this, we combined rule-based detection with AI reasoning. Known threats are detected instantly using lightweight rules, while AI is only used for more complex investigations. This significantly reduces response time and unnecessary AI costs.

Another challenge was designing the system to work in real enterprise environments. We wanted CrowdShield AI to integrate with existing security infrastructure instead of replacing it. That's why we built it around technologies like Sysmon, Splunk Enterprise, Apache Kafka, and Splunk MCP, making the architecture modular and scalable.

What's Next for CrowdShield AI

Software supply chain attacks are growing rapidly, and we believe protecting developer endpoints will become increasingly important. CrowdShield AI is our first step toward solving this challenge.

Our next goal is to reduce detection latency for near real-time response, improve our AI agents with deeper threat investigation and automated remediation, and expand the platform to support more enterprise environments, operating systems, and security integrations.

Built With

  • apache-kafka
  • canvas
  • groq-cloud
  • langchain
  • langgraph
  • microsoft-windows-sysmon-(system-monitor)
  • psutil
  • python
  • splunk
  • splunk-enterprise
  • splunk-model-context-protocol
  • tkinter
  • windows-taskkill
Share this project:

Updates