NemoShield

Welcome Page/Connection Check
Dashboard Overview
AI Investigations Recommendation
AI Investigations Runs Physical Alerts
Graph Trend on Recent Alerts and Severity
Arduino Circuit
Normal State

Inspiration

Most security tools assume someone is watching the dashboard. In reality, alerts get buried, muted, or show up at 2 a.m. when nobody is looking. We wanted an AI agent that doesn't just flag a problem. It should investigate on its own, decide what to do, and make sure a real person actually knows about it.

What it does

NemoShield is a cybersecurity agent powered by NVIDIA Nemotron. When a suspicious event comes in, like dozens of failed SSH logins from one IP in under a minute, the agent starts investigating without anyone asking it to. It pulls recent logs, checks the IP's history against our allowlist, decides how serious the threat is, and responds through a simulated firewall.

The decision doesn't stay on a screen. An Arduino 101 turns it into a physical alert. Green means secure, yellow means the agent is still investigating, and red with a siren means a confirmed critical threat. When someone presses the button on the device, the siren stops and the backend records that a human acknowledged the alert.

How we built it

AI agent. We used NVIDIA Nemotron 3.5 Lightning (nvidia/nemotron-3.5-lightning-30b-a3b) through NVIDIA's OpenAI-compatible API. Before building the agent around it, we tested tool calling directly. Given only a raw event and a tool definition, the model chose to call our IP reputation tool and pulled the correct IP out of the event by itself.

Backend. Python and FastAPI, with an agent loop that lets Nemotron pick from tools for log inspection, IP history, allowlist checks, and a simulated firewall.

Dashboard. Streamlit, showing incidents, the agent's investigation, and the device status.

Hardware. An Arduino 101 with three LEDs, a buzzer, and a push button. The firmware was written around a simple text protocol over USB serial. Every command (NORMAL, WARNING, CRITICAL, CLEAR) gets an acknowledgment back, so the backend knows the alarm really went off instead of just assuming it did. The firmware never blocks, so it can blink, sound the siren, and listen for the button at the same time.

Connecting the two. A Python service maps the agent's severity rating (LOW, MEDIUM, HIGH) to hardware commands and exposes it through a REST API. If the board gets unplugged, the backend keeps running in simulation mode and reconnects automatically once the board is back.

Challenges we ran into

The Arduino 101 has native USB, so unlike most Arduino boards it doesn't restart when the computer opens the serial port. Our startup handshake waited for a "ready" message that never came. We fixed it by having the backend ping the board until it answers.

Uploading firmware to the 101 kept timing out until we figured out the timing for pressing the board's master reset button. The board is no longer produced, so most of the tooling around it is out of date.

We also ran into the usual team problems. We were working on one backend from different laptops over VS Code Live Share, dealing with read-only terminals, a host laptop going to sleep, and a port already taken by a server someone forgot to stop.

The default vertical navigation bar needed more implementation to make it horizontal.

Accomplishments that we're proud of

We tested the full loop on real hardware. The backend sends a critical alert, the Arduino flashes red and sounds the siren, a person presses the button, and the backend logs the acknowledgment with a timestamp. Every step is confirmed, not assumed.

We're also proud that the system fails safely. Pulling the USB cable in the middle of a demo doesn't crash anything.

What we learned

The AI should make decisions, but the system should set the limits. Nemotron never sends raw commands to the hardware. It outputs a severity level, and the backend maps that to a small, fixed set of commands. That keeps the agent useful without giving it control it doesn't need.

We also learned to test each layer on its own before connecting them. We checked the firmware through the serial monitor, the backend against a simulated board, and the model's tool calling with a single script. That made the final integration much faster.

What's next for NemoShield

Tamper detection using the Arduino 101's built-in motion sensor, so physically moving the device becomes a security event the agent can link to network activity
Authenticated commands between the backend and the hardware
Real log sources instead of simulated events
Using Nemotron Content Safety as a second check before high-risk actions