Inspiration
Cyber investigations often require law-enforcement personnel to use many separate websites, APIs, databases, IP tools, domain tools, device-information services, and reporting utilities. Switching repeatedly between these tools makes the investigation process slow, fragmented, and difficult to manage.
We originally created Cyber Search for LEA Work as a single desktop workspace where authorized investigators could access multiple cyber-search and technical-intelligence utilities from one interface.
For OpenAI Build Week, we wanted to make the project more useful than a collection of search tools. Investigation results can contain large amounts of technical information that take time to understand and organize. This inspired us to add an AI Copilot that can help summarize visible results, organize events, identify possible connections, and prepare a structured initial report while keeping the investigator in control.
What it does
Cyber Search for LEA Work is an AI-assisted desktop workspace designed for lawful cyber investigation, cybersecurity research, and authorized training.
The application brings several investigation functions together in one interface, including:
- IP and network-intelligence tools
- Domain and website analysis
- Device and technical-information searches
- API-based investigation utilities
- Local database-backed search modules
- External web investigation tools
- Structured result and reporting screens
The newly added AI Copilot works as an intelligence layer over the existing tools. It can collect information displayed on the current result screen and help the investigator:
- Summarize technical search results
- Arrange available events into a timeline
- Identify possible relationships between indicators
- Highlight important observations and missing information
- Draft a structured investigation report
- Ask natural-language questions about the visible evidence
The Copilot does not make final investigative decisions. Its output is intended to provide leads and assist analysis, and every observation must be independently reviewed by a human investigator.
How we built it
The project is built as a Java desktop application using an existing NetBeans-based codebase.
The original application already contained multiple API integrations, website-based investigation tools, local databases, result tables, and report screens. During Build Week, we used Codex to understand the existing project structure, identify the correct integration points, clean unused modules, and add AI functionality without replacing or breaking the working tools.
We added a visible AI Copilot button to the main application interface. The Copilot can read supported information from the active screen, including labels, text fields, result tables, timestamps, and technical indicators.
The collected information is converted into structured investigation context and sent to the OpenAI API using task-specific instructions for:
- Result summarization
- Timeline generation
- Connection and indicator analysis
- Investigation report drafting
- Custom natural-language questions
The OpenAI API key is not included in the project or source code. Reviewers can enter their own key through the Copilot settings. This protects credentials and prevents secrets from being exposed in the submitted project.
We also prepared the submission version by removing non-working tools, unused social-search modules, personal branding, company details, website references, test records, and unnecessary resources while preserving the working investigation features.
Challenges we ran into
One of the biggest challenges was integrating AI into a large existing application instead of building a new application from scratch. Different modules display their results in different formats. Some use tables, some use labels and text areas, while others open external websites or depend on API responses.
Instead of modifying every existing API individually, we created a common evidence-capture approach that collects supported information from the active screen and converts it into a consistent context for the AI Copilot.
Another challenge was protecting sensitive information. An investigation application can contain credentials, personal details, internal URLs, databases, and real case information. We had to carefully clean the submission version so that no OpenAI API key or real investigation data was included.
We also had to ensure that AI-generated observations did not appear to be final evidence. The Copilot was designed to distinguish facts from assumptions, explain uncertainty, mention missing information, and remind the user that every finding requires human verification.
Preserving the existing working APIs, databases, website-opening functions, and report modules while adding the Copilot was also challenging. We addressed this by adding AI as a separate assistance layer rather than replacing the original search functionality.
Accomplishments that we're proud of
We are proud that we successfully converted an existing multi-tool cyber-search application into an AI-assisted investigation workspace without rebuilding the entire project.
Our main accomplishments include:
- Integrating an AI Copilot into the existing Java desktop application
- Allowing AI analysis to work with information from different result screens
- Adding summarization, timeline, connection-analysis, report-drafting, and question-answering capabilities
- Preserving the existing working APIs, databases, and investigation tools
- Removing non-working and unnecessary modules from the submission build
- Protecting OpenAI credentials by keeping the API key outside the source code
- Preparing a safer demonstration version without real investigation data
- Keeping human verification central to every AI-generated observation
The project demonstrates how an existing operational tool can be improved with AI without replacing its established workflow.
What we learned
We learned that adding AI to an investigation application is not simply a matter of connecting an API. The quality of the output depends heavily on how technical evidence is collected, normalized, structured, and presented to the model.
We also learned that AI is most useful in this type of application when it helps investigators understand and organize information rather than attempting to make final decisions.
Codex helped us navigate a large Java codebase, identify integration points, modify UI components, remove unused modules, and reduce the amount of manual code inspection required.
The project also reinforced the importance of privacy, credential management, transparent limitations, synthetic demonstration data, and human review when developing AI-assisted tools for sensitive workflows.
What's next for Cyber Search For Lea Work
The next step is to expand the AI Copilot so that it can analyze information collected from multiple investigation modules together instead of focusing primarily on the currently visible screen.
Future improvements may include:
- Cross-module evidence correlation
- Case-based investigation workspaces
- Visual relationship graphs for IPs, domains, devices, and other indicators
- Automated chronological case timelines
- Evidence-linked AI answers showing the exact source of each observation
- Exportable investigation reports
- Investigator notes and human approval workflows
- Role-based access control and audit logs
- Configurable data-retention controls
- Offline or private deployment options for sensitive environments
- Multilingual investigation summaries and reports
- Additional validation rules to reduce unsupported AI conclusions
Our long-term goal is to develop Cyber Search for LEA Work into a secure and responsible investigation-assistance platform that helps authorized personnel understand technical information faster while maintaining privacy, accountability, and human control.
Log in or sign up for Devpost to join the conversation.