-
-
set up virtual env
-
code
-
result
-
installing
💡 Inspiration
Modern enterprise infrastructures generate gigabytes of log data every minute. Security Operations Center (SOC) teams are often overwhelmed by "alert fatigue"—sifting through thousands of benign entries to spot sophisticated cyber attacks. We were inspired to build AegisCore AI to automate log triage and drastically reduce Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR) using high-performance AI models.
⚙️ How We Built It
- Language & Runtime: Built using Python 3 for high efficiency and modularity.
- AI Core: Integrated with Nebius and NVIDIA-compatible LLM endpoints (
Meta-Llama-3.1-70B-Instruct) to analyze request vectors, headers, and parameter payloads. - Log Parsing Engine: Created an ingestion module capable of handling web server log streams (HTTP GET/POST requests, status codes, user-agents).
- Automated Remediation: Designed the prompt architecture to output structured JSON responses containing threat severity, attack classification, and immediate WAF/code remediation patches.
🛠️ Challenges We Faced
- Structuring Unstructured Data: Raw server logs can be noisy. Designing system prompts that guarantee reliable, structured JSON outputs for SOC automation required precise prompt tuning.
- Environment Compliance: Resolving Python dependency and virtual environment isolation constraints (PEP 668 compliance) on Linux distribution environments.
- Latency Management: Ensuring that real-time log ingestion and AI threat evaluation return results without choking system throughput.
🎓 What We Learned
- Deepened our understanding of leveraging high-throughput LLM endpoints provided by Nebius and NVIDIA for specialized cybersecurity tasks.
- Learned how to effectively transform generative AI outputs into actionable, structured threat intelligence format.
- Enhanced defensive cybersecurity practices by combining log forensic analysis with automated patch generation.
🔮 What's Next for AegisCore AI
- Live WAF Integration: Direct integration with Cloudflare/Nginx APIs to auto-block IP addresses in real time.
- SIEM Dashboard: Developing a React-based graphical dashboard for visual telemetry and threat metrics.
- Multi-Agent Triage: Deploying specialized sub-agents for forensic analysis, incident reporting, and reverse patch verification.
Log in or sign up for Devpost to join the conversation.