AI Security Log Auditor

Manual log triage takes 15+ minutes and misses stealthy bursts. This dashboard ingests raw Syslog/Nginx/auth.log/Suricata logs, redacts credentials client-side, clusters anomalies with lightweight heuristics, and streams structured threat JSON (threatLevel, attackVector, mitreTechniqueId, confidence, remediation) into an interactive cyber-terminal for instant iptables/fail2ban/nginx mitigations.

Live Demo: https://ai-security-auditor-one.vercel.app · Video: (Unlisted YouTube link) · Blog: (Dev.to/Hashnode link)

Architecture

flowchart LR
  A["Raw Logs<br/>Syslog / Nginx / auth.log"] --> B["Ingestion & Sanitization<br/>redact credentials<br/>cluster anomalies"]
  B --> C["Structured Prompt<br/>threatLevel, attackVector, mitreId"]
  C --> D["AI Inference<br/>Gemini Flash / Ollama"]
  D --> E["Risk & Remediation<br/>Health = 100 - C*25 - W*10"]
  E --> F["Angular Signals<br/>metrics / table / terminal"]
  F --> G["Dark Cyber UI"]

Pipeline highlight file mapping:

• src/app/models/security.model.ts:1 — LogEntry, ThreatReport, MitreTechnique, RemediationAction, DashboardMetrics
• src/app/services/log-generator.service.ts:32 — getAttackPresets() / getSampleLogsByPreset() / parseRawLogLines()
• src/app/services/ai-auditor.service.ts:18 — ingestLogs() → mitreMap (T1110.001, T1190, T1046, T1078) + buildRemediation()
• src/app/components/dashboard/dashboard.component.html:20 — metric bar, src/app/components/dashboard/dashboard.component.html:32 drag-drop zone (dragover)/(drop), src/app/components/dashboard/dashboard.component.html:145 remediation terminal

Tech Stack

Recommended models per spec: Gemini 2.0 Flash (1M context, sub-second) for hosted; Ollama (Qwen 2.5 Coder) for air-gapped — logs never leave browser.

Features

• Ingestion: drag-drop, browse, 6 presets (Full 49 / SSH 15 / SQLi 8 / Recon 5 / API 1 / Clean 20), paste raw text — all via src/app/components/dashboard/dashboard.component.ts:55 onDragOver/onDrop/handleFile
• Sanitization: client-side redaction before any AI call (sanitizedTokensCount in header)
• Metrics: Total Ingested / Critical / Warning / Health 100-(C×25+W×10) with conic ring healthColor()
• Threat Intel: filterable table (search IP/vector/MITRE, severity & vector dropdown) — selectable row opens inspector with aiAnalysis, MITRE link, IoCs, raw redacted line
• Terminal: per-threat iptables/fail2ban/ufw/nginx with Copy, Run (Sim), Copy All, Export .sh (downloadScript()), simulated stdout

Quick Start

# prerequisites: Node 20+, npm 10+
git clone https://github.com/prabanjan127/ai-security-auditor.git
cd ai-security-auditor
npm install          # installs [email protected] + [email protected] per angular.json:33
ng serve             # http://localhost:4200 — dashboard auto-loads Full Attack Suite
ng test              # 2/2 passing (src/app/app.spec.ts:1)
npm run build        # → dist/ai-security-auditor/browser/

Try it:

1. Click Load Sample Attack Logs or any preset pill.
2. Or drop a .log (e.g. auth.log with Failed password for invalid user admin from 203.0.113.5).
3. Filter by CRITICAL, search 203.0.113, select a row → copy sudo iptables -A INPUT -s 203.0.113.5 -p tcp --dport 22 -j DROP from terminal.

Deploy

Vercel (recommended)

npm i -g vercel
vercel --prod  # uses vercel.json (output: dist/ai-security-auditor/browser)

vercel.json already contains SPA rewrite /(.*) → /index.html.

Netlify / GitHub Pages

npm run build
# Netlify: drag dist/ai-security-auditor/browser
# GH Pages: npx angular-cli-ghpages --dir=dist/ai-security-auditor/browser

Project Links (replace before submit)

• GitHub: https://github.com/prabanjan127/ai-security-auditor
• Live Demo: https://ai-security-auditor-one.vercel.app
• Blog (Dev.to/Hashnode): paste draft from prompt + screenshots above
• Video (Unlisted YouTube): 0:00 problem / 0:30 upload demo / 1:30 architecture

How It Works (for blog/video)

1. Ingest — drop .log → LogGeneratorService.parseRawLogLines() clusters anomalies.
2. Sanitize — sanitizeLine() redacts Bearer/api_key before inference.
3. Infer — structured prompt expects {threatLevel, attackVector, mitreTechniqueId, confidenceScore, remediationCommands}.
4. Score — calculateDashboardMetrics() → health.
5. Display — DashboardComponent binds via applyFilters() / selectReport(); terminal streams terminalOutput[].

License

MIT — showcase project; not for production firewall automation without review.