AILogAssistant

LogAssistant is an AI-powered network threat analysis system. It ingests raw network/access logs, runs them through a configurable rule engine with signature and volumetric detection rules, and when a rule is triggered, hands suspicious activity to an LLM security agent. The agent investigates using a MITRE ATT&CK knowledge base and IP activity history, then produces a structured threat report with type, severity, mitigation plan, and recommendations. Reports are persisted and broadcast live over WebSocket to a Streamlit dashboard.

The system includes a configurable rule engine defined in a JSON policy file and validated with Pydantic. Its LLM security agent is a LangChain tool-calling agent (Claude) that returns a structured, schema-validated threat report. Batch analysis is machine-to-machine only, protected by a JWT obtained via an OAuth2 client_credentials flow. The project also provides async persistence with SQLAlchemy 2.0 async ORM, structured logging with structlog, and a test suite that mocks the LLM and vector store.

The tech stack includes FastAPI, LangChain (Anthropic Claude), Qdrant, HuggingFace embeddings, SQLAlchemy (async), Pydantic v2, structlog, PyJWT, Streamlit, WebSocket client, pytest, pytest-cov, anyio, and Docker Compose. A Bruno collection is included under bruno/ with example requests for every endpoint.