LogWatcher ID

• 

  Result Risk Score

Inspiration

As a fresh Computer Science graduate from Manado, Indonesia, I've been building my portfolio through hackathons while job hunting. Beyond the technical challenge, I'm motivated to push my skills further winning this hackathon would help me upgrade my development tools, allowing me to build even better projects in the future.

But the real inspiration came from a sobering realization: Indonesia has suffered some of the world's largest data breaches , BPJS Kesehatan (279 million records), KPU (204 million), Tokopedia (91 million), PLN (17 million) , yet there's no free, Indonesian-language tool for ordinary citizens to check if their personal data was exposed. Most cybersecurity tools are in English and built for technical audiences. I wanted to build something my own family and community could actually use.

What it does

LogWatcher ID is a bilingual AI agent (Bahasa Indonesia + English) that helps Indonesian citizens check if their email, phone number, or password has been exposed in known data breaches.

Users simply enter their email, phone number, and/or password. The system then:

1. Checks the password against HaveIBeenPwned's Passwords API using k-anonymity (the actual password never leaves the device , only a partial SHA-1 hash is sent)
2. Cross-references the input against an Indonesian breach database (BPJS, KPU, Tokopedia, Bukalapak, PLN, IndiHome, BCA)
3. Generates a personalized investigation report using Groq's LLaMA 3.3 70B model , written in plain, non-technical language
4. Calculates a Risk Score (0-100)
5. Logs the entire investigation to Splunk Cloud via a custom 4-tool MCP pipeline

How we built it

• Frontend: Streamlit, styled with custom CSS for a dark, security-focused dashboard aesthetic
• AI Agent: Python orchestrator calling Groq's LLaMA 3.3 70B API for bilingual report generation
• Breach Data: HaveIBeenPwned Passwords API (free, privacy-preserving) combined with a curated Indonesian breach database based on real publicly-reported incidents
• Splunk Integration: Built a custom MCP-style pipeline using Splunk HTTP Event Collector (HEC), with 4 distinct tools (log_investigation, log_risk_alert, log_password_check, log_summary_report) ,each logging structured events to Splunk Cloud with its own sourcetype
• Environment: Developed entirely on WSL2/Ubuntu running on a low-spec laptop (AMD A4, 4GB RAM), proving this solution is accessible even with minimal hardware

Challenges we ran into

• Splunk Cloud REST API (port 8089) is blocked on free trial accounts we couldn't use the traditional Splunk SDK search API directly. We pivoted to building our MCP pipeline entirely through HEC (port 8088), which worked reliably.
• Model deprecation: Our initial Groq model (llama3-70b-8192) was decommissioned mid-build quickly migrated to llama-3.3-70b-versatile.
• Limited hardware (4GB RAM): Required careful dependency management and avoiding heavy local installations chose Splunk Cloud over local Splunk Enterprise to save resources.
• Bilingual implementation: Needed to dynamically switch both UI labels and AI-generated content between Bahasa Indonesia and English based on user selection.

Accomplishments that we're proud of

• Built a fully functional, end-to-end AI security pipeline, from user input to AI-generated bilingual report to Splunk logging in a single intensive build session
• Successfully integrated 4 distinct MCP-style tools with Splunk Cloud, each producing structured, queryable security events
• Created a genuinely bilingual experience where both the UI and AI-generated content seamlessly switch between Bahasa Indonesia and English
• Implemented privacy-preserving password checking using k-anonymity a real-world security best practice
• Proved that a meaningful AI + Splunk security tool can be built entirely with free tools, on a low-spec laptop (4GB RAM), by a solo fresh graduate developer
• Addressed a real gap for 270 million Indonesians who currently have no accessible way to check their data breach exposure in their own language

What we learned

• How to design a security pipeline using Splunk HEC when traditional REST API access isn't available
• Practical implementation of k-anonymity for privacy-preserving password checks
• Prompt engineering for bilingual, non-technical security reports using LLaMA 3.3
• Building functional AI products under extreme resource constraints (free tier only, 4GB RAM)

What's next for LogWatcher ID

• Expand the Indonesian breach database with more verified incidents
• Add email verification to prevent abuse
• Build Splunk dashboards/visualizations directly into the app
• Deploy publicly so all 270 million Indonesians can access it for free

Built With

• groq
• haveibeenpwned
• http-event-collector
• llama
• python
• rest-api
• splunk
• splunk-mcp
• streamlit