Find Evil Agent

• 

  project repostory

• 

  Find Evil Agent — architecture

Inspiration

What it does## Inspiration

Security analysts deal with 500+ alerts daily. At 3 AM during an active attack, manually reading logs is slow and exhausting — real threats get missed due to human fatigue. I wanted to build an AI agent that never sleeps, never gets tired, and never misses a threat.

What It Does

Find Evil Agent is an autonomous incident response agent running on SIFT Workstation. It:

• Analyzes real attack logs automatically
• Self-corrects its own false positives
• Generates professional incident reports
• Saves full execution audit trail
• All with zero human intervention

How I Built It

• Platform: SIFT Workstation (Linux)
• Language: Python 3.12
• AI Model: Groq API — LLaMA 3.3 70B
• Evidence: Real Apache logs from SIFT system
• Tools: Git, VirtualBox, Cursor IDE

The agent uses a two-brain architecture:

• Brain 1 — Junior analyst that finds threats
• Brain 2 — Senior reviewer that self-corrects mistakes

Challenges

• Getting the agent to run natively on SIFT Linux
• Implementing meaningful self-correction without infinite loops
• Finding real evidence datasets for testing
• Balancing security (prompt injection protection) with functionality

What I Learned

• How real forensic investigators use SIFT tools
• Prompt engineering for cybersecurity analysis
• Importance of self-correction in AI agents
• Real-world attack patterns from Apache logs

Links

• GitHub: https://github.com/zenithVeil/find-evil-agent
• Built for: SANS FIND EVIL! Hackathon 2026

How we built it

Challenges we ran into

Accomplishments that we're proud of

What we learned

What's next for Find Evil Agent

Agent uses Groq's LLaMA 3.3 70B for AI inference as an open-source alternative to Claude, orchestrated as a Multi-Agent Framework on SIFT Workstation.

Built With

• 3.3-70b
• git
• github
• groq
• linux
• llama
• python
• python-dotenv
• sift
• virtualbox
• workstation