GuardBee

GuardBee helps small businesses detect suspicious login activity, assess cyber risks, retrieve relevant security policies,and generate evidence-grounded AI investigation reports using NVIDIA Nemotron.

Comment

Inspiration

Small businesses often lack dedicated security teams to investigate suspicious login activity. Understanding security alerts, identifying risks, and finding relevant security policies can be challenging.

We built GuardBee to make security investigation more accessible through deterministic analysis and AI-assisted reporting.

What it does

GuardBee is a security analytics console for investigating suspicious login activity using synthetic incident data.

Its key capabilities include:

  • Incident Validation: Validates incident data before processing.
  • Risk Analysis: Applies deterministic rules to calculate risk scores, severity, and classifications.
  • Policy Retrieval: Uses TF-IDF and cosine similarity to find relevant security policies.
  • AI Investigation Reports: Uses NVIDIA Nemotron through Nebius Token Factory to generate evidence-grounded investigation reports.
  • Citation Validation: Checks event and policy references in AI-generated reports.
  • Simulated Decisions: Supports investigation decisions with context validation and session-level audit history.

How we built it

We built GuardBee using Python and Streamlit. The risk analysis engine operates independently of the AI reporting component.

Policy retrieval uses TF-IDF and cosine similarity. NVIDIA Nemotron provides AI-assisted investigation reports through the Nebius Token Factory API.

Challenges we ran into

Our main challenges were validating incident data, maintaining deterministic risk calculations, retrieving relevant policies, and ensuring AI-generated reports reference valid evidence and policy IDs.

We also worked to keep AI-generated conclusions separate from deterministic security analysis.

Accomplishments that we're proud of

  • Built a complete Streamlit-based security investigation interface.
  • Implemented deterministic risk scoring and incident classification.
  • Integrated policy retrieval.
  • Integrated NVIDIA Nemotron through Nebius Token Factory.
  • Implemented event and policy citation validation.
  • Completed a test suite with 133 passing tests.

What we learned

We learned how to combine deterministic security logic with AI-assisted investigation while maintaining clear evidence boundaries, structured validation, and transparent limitations.

What's next for GuardBee

Future improvements include persistent audit history integration, broader incident coverage, stronger AI output verification, and integration with real security data sources.

Built With

Share this project:

Updates

Submission history