EventraAI is an advanced AI-powered Security Operations Center (SOC) assistant that automates security incident analysis, investigation, and response through intelligent multi-agent workflows. Built with cutting-edge AI technologies, it provides comprehensive threat detection, investigation, and remediation capabilities with human-in-the-loop validation.
- Automated parsing and structuring of security logs
- Advanced anomaly detection using AI agents
- Multi-dimensional threat assessment
- 7-Layer Architecture: Orchestration → Detection → Investigation → Validation → Response → Monitoring → Management
- 12+ Specialized AI Agents: Each designed for specific security tasks
- Human-in-the-Loop: Critical decisions require human validation
- LangGraph Orchestration: Complex workflow management with state persistence
- Google Gemini Integration: Powered by Gemini-2.5-Flash for intelligent analysis
- Tree-of-Thought Reasoning: Multi-step decision making process
- Fact-Checking: AI hallucination prevention and validation
- Real-time threat intelligence correlation
- MITRE ATT&CK framework integration
- Behavioral memory and pattern recognition
- Automated remediation with rollback capabilities
- Trust calibration and confidence scoring
- Modern Streamlit-based web interface
- Historical case management and analytics
- Real-time workflow monitoring
- Exportable incident reports
EventraAI employs a sophisticated 7-layer architecture:
┌─────────────────────────────────────────────────────────────┐
│ LEVEL 1: ORCHESTRATION │
├─────────────────────────────────────────────────────────────┤
│ LEVEL 2: DATA PROCESSING & DETECTION │
│ • Data Collection Agent • Detection Agent │
├─────────────────────────────────────────────────────────────┤
│ LEVEL 3: CONTEXTUAL ENRICHMENT & INVESTIGATION │
│ • Investigation Agent • Threat Intelligence Agent │
│ • Context Agent • Correlation Agent │
├─────────────────────────────────────────────────────────────┤
│ LEVEL 4: VALIDATION & EXPLANATION │
│ • Fact-Checker Agent • Explainability Agent │
├─────────────────────────────────────────────────────────────┤
│ LEVEL 5: DECISION & RESPONSE │
│ • Remediation Strategy • Response Orchestration │
│ • Human Feedback • Execution Agent │
├─────────────────────────────────────────────────────────────┤
│ LEVEL 6: MONITORING & FEEDBACK │
│ • Trust Calibration • Simulation Training │
│ • Behavioral Memory • One-Click Rollback │
├─────────────────────────────────────────────────────────────┤
│ LEVEL 7: SUPPORT & MANAGEMENT │
│ • Analyst Copilot • Case Summary │
│ • Conversation Summary │
└─────────────────────────────────────────────────────────────┘
- Python 3.8 or higher
- Google AI API key (for Gemini integration)
- Clone the repository
git clone https://github.com/SyedAffan10/Eventra-AI.git
cd Eventra-AI/code- Install dependencies
pip install -r requirements.txt- Environment Configuration
Create a
.envfile in the root directory:
GOOGLE_API_KEY=your_google_api_key_here- Initialize Database
python db.py- Run the Application
streamlit run app.pyThe application will be available at http://localhost:8501
- Navigate to the "Log Analysis" tab
- Paste your security logs or upload a log file
- Click "Analyze Logs" to start the AI workflow
- Review the automated analysis and alerts
- Approve or modify the recommended remediation actions
- View past security incidents and their analysis
- Filter cases by user, threat level, or date range
- Export case data for compliance reporting
- Learn from past incidents to improve detection
- Configure API keys and system parameters
- Manage database operations
- Monitor system health and performance
- Access debug and maintenance tools
Main Streamlit application providing the web interface for:
- Interactive log analysis
- Historical case management
- System configuration and monitoring
Core AI agent implementations featuring:
- Multi-agent security workflow orchestration
- LangGraph-based state management
- Intelligent decision-making with human validation
- Comprehensive threat analysis pipeline
Database management system for:
- SQLite-based case storage
- Workflow result persistence
- Historical data analytics
Centralized logging system with:
- Rotating file handlers
- Configurable log levels
- Performance monitoring
The system processes security incidents through specialized AI agents:
- Data Collection Agent: Parses and structures raw security logs
- Detection Agent: Identifies suspicious activities and anomalies
- Investigation Agent: Conducts deep analysis with geolocation and context
- Threat Intelligence Agent: Correlates with external threat feeds
- Context Agent: Provides historical and behavioral context
- Correlation Agent: Links related events into threat narratives
- Fact-Checker Agent: Validates findings against raw data
- Explainability Agent: Generates human-readable explanations
- Remediation Strategy Agent: Determines appropriate response actions
- Response Orchestration Agent: Plans and executes remediation
- Trust Calibration Agent: Monitors AI decision accuracy
- Case Summary Agent: Generates comprehensive incident reports
- SOC Automation: Reduce analyst workload with intelligent triage
- Incident Response: Automated investigation and remediation planning
- Threat Hunting: Proactive threat detection and correlation
- Compliance Reporting: Automated documentation and case management
- Training: Learn from AI analysis to improve security practices
- Human-in-the-Loop: Critical decisions require human approval
- Fact Checking: Built-in validation to prevent AI hallucinations
- Rollback Capability: One-click reversal of automated actions
- Trust Scoring: Confidence metrics for AI recommendations
- Audit Trail: Complete logging of all decisions and actions
- AI/ML: LangChain, LangGraph, Google Gemini AI
- Frontend: Streamlit, Pandas, Altair
- Backend: Python, SQLite
- APIs: Google AI Generative Language
- Security: Azure integration capabilities, MITRE ATT&CK framework