GHOST(Generative Hunting & Operations Security Toolkit)

• 

  GHOST: an AI security analyst that investigates every alert like a human expert, and lets a human make the final call.

• 

  Two layers: fast rules scan every event, then an NVIDIA Nemotron agent on Nebius investigates each alert with real tools.

• 

  The GHOST console on a real Empire PsExec attack: 4,335 Windows events, 3 alerts, 3 confirmed attacks, about 10 s per alert.

• 

  Live attack map: a replay of the real machines and connections in the logs, with GHOST tracing each alert as it investigates.

• 

  Activity timeline with alert markers, and the attack chain Nemotron rebuilt: hidden PowerShell, a fake service, then a C2 beacon.

• 

  Every alert gets a verdict, a confidence score, numbered evidence from the logs and MITRE ATT&CK techniques backed by that evidence.

• 

  The investigation trail in plain English: each tool Nemotron called and what it found, from log searches to decoding PowerShell.

• 

  Not an attack: Microsoft's Azure agent reading LSASS looks like credential theft. Nemotron called it a false positive, matching the key.

• 

  Bring your own logs: upload GHOST-format or raw Windows event logs, and GHOST detects and investigates them live.

• 

  8 of 8 answer-key techniques across 4 real OTRF attacks and a practice attack, 0 made-up techniques, about 11 s per alert.

• 

  Guardrails: self-correction, a grounding check, ATT&CK suggestions kept apart from evidence, and a human approving every action.

• 

  6 rounds of tuning the AI: each problem, the fix and the result. No retraining, only better instructions, tools and checks.

• 

  Every benchmark run, including the loophole we found in our own checker, from 1,312 s on a free endpoint to 160 s on Nebius.

• 

  NVIDIA RAPIDS: the same detection code runs 8.9x faster on a GPU over 5 million events, with identical alerts on CPU and GPU.

Try it live: pick an attack at ghost-soc.streamlit.app and press ▶ Run live investigation to watch Nemotron investigate in real time.

Inspiration

I'm a cybersecurity student, and one fact kept bothering me: security teams receive thousands of alerts a day, and most never get investigated. Real attacks hide in that noise. I wanted to see whether an AI agent could do the first investigation the way a skilled analyst would, so humans spend their time only on decisions that matter.

What it does

GHOST (Generative Hunting & Operations Security Toolkit) turns raw security logs into investigated incidents.

1. Detect: eight fast detection rules scan every event, from brute force and exfiltration to PsExec-style service creation, WMI remote execution, encoded PowerShell, and Mimikatz-style reads of LSASS memory.
2. Investigate: for each alert, an NVIDIA Nemotron agent served through Nebius Token Factory decides which tools to use: searching logs, following Windows process chains, decoding hidden PowerShell, checking IP reputation, comparing behavior to what's normal for that user, and mapping findings to MITRE ATT&CK.
3. Connect the dots: the agent sees earlier findings, so it links separate alerts into one attack chain.
4. Recommend, don't act: GHOST suggests containment steps, but a human approves every action in the dashboard.
5. Bring your own logs: upload a log file in the dashboard (GHOST format or raw Windows Security/Sysmon events) and watch Nemotron investigate it live.

I tested it on 4 real attacks recorded by the OTRF Security Datasets project (Empire PsExec, SMBExec, WMI and Mimikatz) plus a synthetic attack: 25,461 events in total.

The answer key for each real attack is the dataset's official label, not mine. Every technique GHOST reports is backed by evidence from that investigation, and it correctly dismissed a legitimate Microsoft Azure agent reading LSASS memory, which a simple rule would have flagged as credential theft.

How I built it

• Data: a loader that downloads OTRF recordings and normalizes raw Windows Security and Sysmon events into one schema, keeping the background noise so detection scans the full haystack. Each scenario has an answer key the detectors and agent never see.
• Detection: Python and pandas, written so the same code runs on an NVIDIA GPU through RAPIDS cudf.pandas with no changes. On 5 million events, an NVIDIA T4 runs all eight detectors 8.9x faster than the CPU (25.7 s to 2.9 s) and raises the identical 1,771 alerts. Each rule carries ATT&CK tags, like Sigma rules do.
• Agent: Nemotron 3.5 Lightning via Nebius Token Factory's OpenAI-compatible API, with tool calling in a custom agent loop and structured JSON reports. The same code also runs against NVIDIA NIM: switching providers is a settings change. On Nebius, the full benchmark's agent time dropped from 1,312 s to 160 s with identical accuracy, about 11 seconds per alert.
• Knowledge base: all 706 MITRE ATT&CK v20 techniques, built from MITRE's official STIX data and searched with BM25 ranking. Search results are reference, not evidence: a technique the logs don't support is shown as "possible" for an analyst, never counted.
• Uploads: a parser that accepts GHOST-format events or raw Windows event logs and runs them through the same normalizer as the real scenarios. The raw OTRF PsExec and Mimikatz files produce exactly the same events and alerts as the built-in versions.
• Dashboard: Streamlit, with a scenario picker, live step-by-step investigations, the reconstructed attack chain, and approve/reject buttons.
• Benchmark: one command runs every scenario and scores detection and agent separately.

Challenges I ran into

The agent found the right answer but lost it. On the first real attack, Nemotron scored 0/1. One investigation reached the correct verdict but wrote invalid JSON; another ran out of steps while still reasoning in prose. I added self-correction: when a report can't be parsed, the agent sees its own error and fixes it once. The next run scored 1/1, confirmed 3 of 3 alerts, and finished in about 2 minutes instead of 16.

The agent made things up. Once it claimed "File Deletion" (T1070.004) with no supporting evidence. I added a grounding check: a technique only counts if it appeared in the alert's rule tags or in a tool result during that investigation.

Then the grounding check had a loophole of its own. Reviewing the live demo, I spotted "Exfiltration Over Alternative Protocol" (T1048) on an SMBExec alert, where no data left the network. When the MITRE lookup found no match, it listed every known technique as options, and the checker counted that menu as evidence. After closing the loophole, the next run caught 2 real hallucinations ("Hidden Files" and "Visual Basic"), but it also rejected 4 true PowerShell claims, because my tools never connected evidence to techniques. I made the lookup accept lists of technique IDs and had the PowerShell decoder state which techniques its findings prove. The final run scored 8/8 with every reported technique backed by evidence. Testing the tester mattered as much as testing the AI.

My detectors missed an attack. When I ran the PsExec-era rules on three new real attacks, they caught SMBExec unchanged, caught only side effects of the WMI attack, and missed the Mimikatz password theft entirely. I studied the raw events and wrote two new detectors.

Scaling to millions broke my detectors. To test the GPU, I copied the real logs into 5 million events. The first run never finished: two detectors re-scanned every log for each suspicious event, fine at 25,000 events and hopeless at millions. I rewrote them as single table-wide joins. The first GPU run was then only 1.5x faster, because two detectors used operations RAPIDS can't run on a GPU (a case-insensitive regex and a Python loop over groups), so the work quietly fell back to the CPU. After rewriting those, the GPU was 8.9x faster, and every rewrite produced identical alerts on all five real scenarios. One detector, lateral movement, is still faster on the CPU, because it walks each user's logins in time order.

Real data has legitimate look-alikes. The SMBExec recording contains Microsoft's Azure guest agent reading LSASS memory. Instead of hard-coding an exception, GHOST raises it as a medium alert and lets the agent decide. Nemotron traced the parent process (WaAppAgent.exe) and called it a false positive.

What I learned

• Agents fail in specific, fixable ways. Tool design, feedback and guardrails mattered as much as the model.
• Two layers beat one. Cheap detection plus expensive LLM investigation is far more practical than sending every log line to a model.
• Measure honestly. Answer keys from someone else, a record of what failed, and false-positive checks turned "it seems to work" into numbers.
• Check the checker. A guardrail with a loophole gives false confidence; mine let a wrong technique through until I looked at real output closely.
• Keep humans in the loop. In security, AI should speed up decisions, not make them alone.

What's next

• Move the last CPU-bound detector (lateral movement) onto the GPU
• Read more log formats for uploads: Windows .evtx files, Linux and cloud audit logs
• More OTRF recordings and live threat-intelligence APIs

Built With

• cudf
• github
• google-colab
• mitre-att&ck
• nebius-token-factory
• nvidia-nemotron
• nvidia-nim
• nvidia-rapids
• openai-api
• pandas
• python
• streamlit
• sysmon