FIRE – Fraud and Insider Risk Evaluation

Sample result

Inspiration

Motivated by real-world headlines involving remote insider threats, where fraudulent IT workers gained unauthorized access to corporate networks. These events revealed how difficult it is to detect threats from within—especially when activity seems legitimate on the surface.

What it does

This solution empowers security teams to detect risks early by connecting the dots across user behavior logs.

How we built it

Built FIRE using: - Python for tool development - Google ADK to create a Supervisor Agent - Modular tools to analyze logs from Git, VPN, Cloud Access, and Endpoints -A Supervisor Agent that: -Calls individual tools - Summarizes the results -Determines if the user is a "Threat", "Potential Risk", or "No Concern"

Challenges we ran into

Data Diversity: Logs came in different structures. Behavior Baselines: Defining what counts as "normal" behavior was tricky without historical data. Agent Tooling: Integrating custom Python tools into a smooth agent workflow via ADK was a learning curve, but ultimately a rewarding experience.

Accomplishments that we're proud of

-Built a Working Multi-Log Threat Detection Agent -Designed and Deployed a Supervisor Agent -Achieved End-to-End Threat Evaluation

What we learned

Learnt how to build AI-assisted security tools using real-world log formats like Git activity, VPN sessions, and cloud access. We also learned how to design simple anomaly detection logic, and use Google ADK to orchestrate tools through a central decision-making agent.

What's next for FIRE – Fraud and Insider Risk Evaluation

Real-time Streaming Integration - Plan to evolve FIRE from batch log analysis to a real-time threat detection system by integrating streaming platforms. This will enable near-instant alerts as soon as suspicious activity occurs. Role-based Behavior Modeling - Implement dynamic baselines based on a user’s role, department, and past behavior. This allows FIRE to distinguish between a developer pushing code at 2AM (normal) and an HR employee doing the same (suspicious). User Feedback Loop - Add a feedback mechanism that allows analysts to mark threats as true or false positives. FIRE will use this feedback to continuously learn and adapt, improving its precision over time. Threat Timeline Visualization - To build a timeline dashboard showing the user’s activities, anomalies, and severity scores across systems.