ThreatHunter Agent — Agentic AI

user interface for the web app

Inspiration

Every day, security teams drown in thousands of log lines :Apache access logs, firewall drops, SSH failures and most threats go unnoticed simply because there aren't enough human eyes. We asked ourselves: what if an AI agent could work like a tireless SOC analyst, reading every log line, connecting the dots, and handing you a complete incident report in seconds?

That question became ThreatHunter.

As a four-person team with a combined background in development and cybersecurity, we've seen firsthand how small teams and startups have zero capacity for 24/7 threat monitoring. We wanted to build something that actually solves that not just a demo, but a real autonomous agent pipeline.

What It Does

ThreatHunter is an end-to-end autonomous SOC analyst powered by Amazon Nova Pro. You drop in raw logs Apache, Nginx, SSH, firewall, or even a CICIDS network flow CSV and the agent:

Parses: unstructured log data into structured events
Detects suspicious patterns like brute force, SQL injection, port scans, and data exfiltration
Enriches findings with real threat intelligence via AbuseIPDB
Reasons using Amazon Nova Pro to generate a human-readable threat narrative
Reports a full PDF incident report with MITRE ATT&CK mapping, IOCs, severity rating, and step-by-step remediation The entire pipeline runs autonomously through LangGraph, no human in the loop required.

How We Built It

We built ThreatHunter as a full-stack application in under 48 hours: 1.Backend: FastAPI + LangGraph for the agent orchestration pipeline, with five dedicated nodes (parse → detect → enrich → reason → report)

AI Brain: Amazon Nova Pro via AWS Bedrock for threat reasoning and narrative generation; Amazon Nova Lite for network flow CSV analysis 3.Frontend: React 18 + Vite with a custom professional UI no component libraries, pure CSS with a gold/navy intelligence-agency aesthetic 4.Reports: ReportLab-generated PDFs with MITRE ATT&CK tables, IOC listings, and remediation steps

We deliberately kept the architecture modular so each node in the pipeline can be improved independently.

Challenges We Ran Into

The biggest challenge was making the agent handle truly unstructured logs. Real-world logs don't follow clean formats timestamps differ, fields are missing, and log sources vary wildly. Getting the parse node to reliably extract structured data from chaotic input took significant iteration.

We also hit merge conflicts and GitHub branch management issues as a four-person remote team working simultaneously on frontend and backend something every real dev team faces but hackathon projects rarely mention honestly.

Integrating AWS Bedrock with LangGraph required careful handling of streaming responses and tool call formats that weren't always well-documented.

Accomplishments That We're Proud Of

A fully autonomous 5-stage agent pipeline that goes from raw logs to PDF report
Real MITRE ATT&CK mapping automatically applied to detected threats
Support for multiple log formats including CICIDS network flow datasets
A professional, production-grade frontend built entirely from scratch
End-to-end working demo with zero manual intervention required

What We Learned

How to orchestrate multi-step AI agents using LangGraph with real state management
The power and flexibility of Amazon Nova Pro for open-ended reasoning tasks
How real SOC workflows actually work — and where AI can genuinely replace hours of manual analysis
That building a clean, professional UI matters as much as the AI logic when demonstrating a product to judges and users

What's Next for ThreatHunter

1.Live SIEM integration : Connect directly to Splunk, Elastic, or CloudWatch 2.Real-time monitoring: Continuous log streaming instead of batch uploads 3.Multi-agent collaboration: Separate specialized agents for network, endpoint, and cloud logs 4.CVE correlation: Automatic cross-referencing with NVD for vulnerability context 5.Slack/Teams alerts: Push critical findings directly to your team's channels

ThreatHunter proves that AI can genuinely automate the most time-consuming parts of security operations — and we're just getting started.