Inspiration
Cybersecurity analysts often face overwhelming amounts of log data and alerts. While AI can help analyze this information, AI systems can sometimes make unsupported assumptions or hallucinate findings. We wanted to build a system that not only analyzes threats but also verifies its own conclusions.
What it does
ThreatLens is a self-correcting AI incident response assistant.
It allows users to upload security logs and files, performs AI-powered threat analysis, generates an initial incident report, and then uses a secondary verification agent to review and validate the findings.
The platform also creates audit logs, confidence scores, and downloadable PDF reports.
How we built it
ThreatLens was built using:
- Python
- FastAPI
- Gemini AI
- HTML/CSS
- Jinja2 Templates
- ReportLab
The system uses a multi-agent workflow:
- Analyzer Agent
- Verification Agent
- Audit Logging System
- PDF Report Generator
Challenges we ran into
One of the biggest challenges was designing a workflow that could reduce AI hallucinations while still producing useful security insights.
We also had to create a verification pipeline that reviews AI-generated findings and highlights unsupported conclusions.
Accomplishments that we're proud of
- Built a complete AI-powered incident response workflow
- Implemented self-correction through a verification agent
- Added audit trail generation
- Created downloadable PDF reports
- Developed a modern cybersecurity dashboard
What we learned
We learned how multi-agent AI systems can improve reliability by validating outputs rather than relying on a single model response.
We also gained experience building AI-powered cybersecurity tools using FastAPI and Gemini.
What's next for ThreatLens
Future development includes:
- Dynamic risk scoring
- Advanced threat intelligence integration
- SIEM log ingestion
- Real-time monitoring
- Enhanced explainability and reasoning visualization
- Enterprise reporting and collaboration features
Log in or sign up for Devpost to join the conversation.