SISA - Secure Data Intelligence Platform

A unified, enterprise-grade system for detecting sensitive data, analyzing logs, and assessing security risks with AI-powered insights.

📋 Features

✅ 18+ Sensitive Data Patterns

• Credentials: passwords, API keys, tokens, JWTs
• Cloud: AWS, Azure, GCP keys
• Financial: credit cards, SSNs
• PII: emails, phone numbers, IPs
• Database: connection strings

✅ Advanced Log Analysis

• Brute-force detection
• SQL injection patterns
• Path traversal attempts
• Stack trace leaks
• Suspicious IP tracking

✅ Weighted Risk Scoring (0-100)

• Dynamic calculation based on severity & frequency
• Clear risk levels: CRITICAL | HIGH | MEDIUM | LOW | SAFE
• Recommended actions for each level

✅ Multi-AI Support

• Gemini (Primary): Free, fast, accurate
• Claude (Fallback): Advanced analysis
• Rule-Based (Always Works): Deterministic insights

✅ Data Masking & Policies

• Smart masking profiles per data type
• Content blocking for critical risks
• Preserves data structure while protecting values

✅ Modern Frontend (Brutalist Design)

• Pure Monochrome Brutalism (Dark & Light mode toggle)
• Raw ASCII decorators and stark structural elements
• Heavy borders, high-contrast states, and Space Mono typography
• Tab-based workflow and risk fraction metrics
• Ready-to-go Sample Data loading for demos
• File upload with drag-and-drop

✅ Production-Ready

• Async FastAPI backend
• Docker & Docker Compose
• Vercel deployment ready
• Comprehensive pytest suite
• Type hints throughout

---

🚀 Quick Start

Prerequisites

• Python 3.11+
• Node.js 18+
• Docker & Docker Compose (optional)
• API Keys:
  • Google Gemini
  • Anthropic Claude

1. Clone & Setup

cd SISA

# Copy environment template
cp .env.example .env

# Edit .env with your API keys
nano .env

2. Backend Setup

cd backend

# Create virtual environment
python -m venv venv
source venv/bin/activate  # On Windows: venv\Scripts\activate

# Install dependencies
pip install -r requirements.txt

# Run migrations (if applicable)
# python -m alembic upgrade head

# Start server
uvicorn main:app --reload
# Server will be available at http://localhost:8000

3. Frontend Setup

cd frontend

# Install dependencies
npm install

# Start development server
npm run dev
# App will be available at http://localhost:5173

4. Access the Application

• Frontend: http://localhost:5173
• API Docs: http://localhost:8000/docs
• OpenAPI Schema: http://localhost:8000/openapi.json

---

🐳 Docker Deployment

Single Command

# From project root
docker-compose up --build

# Services will start:
# - Backend: http://localhost:8000
# - Frontend: http://localhost:5173

Manual Docker Build

# Backend
cd backend
docker build -t sisa-backend:3.0.0 .
docker run -p 8000:8000 \
  -e GEMINI_API_KEY=your_key \
  -e ANTHROPIC_API_KEY=your_key \
  sisa-backend:3.0.0

# Frontend
cd frontend
docker build -t sisa-frontend:3.0.0 .
docker run -p 5173:5173 sisa-frontend:3.0.0

---

📊 API Examples

1. Analyze Text Content

curl -X POST http://localhost:8000/api/analyze \
  -H "Content-Type: application/json" \
  -d '{
    "input_type": "text",
    "content": "Database password: p@ssw0rd123\nAPI Key: sk-live-abc123xyz",
    "options": {
      "mask_output": true,
      "use_ai": true,
      "block_on_critical": true,
      "enable_log_analysis": false
    }
  }'

2. Response Format

{
  "summary": "Analysis detected 2 CRITICAL findings and 1 HIGH finding. Risk level: CRITICAL.",
  "findings": [
    {
      "finding_type": "password",
      "severity": "critical",
      "label": "Password",
      "value": "p@ssw0rd123",
      "masked_value": "***REDACTED***",
      "line": 1
    }
  ],
  "anomalies": [],
  "risk_score": 85,
  "risk_level": "CRITICAL",
  "action": "BLOCK_IMMEDIATE - Quarantine content and escalate to security",
  "insights": [
    "Critical credentials exposed in plain text",
    "Immediate credential rotation required"
  ],
  "recommendations": [
    "Rotate all exposed credentials immediately",
    "Review access logs for unauthorized activity"
  ],
  "masked_content": "Database password: ***REDACTED***\nAPI Key: sk-live-***",
  "metadata": {
    "timestamp": "2024-03-26T12:34:56.789Z",
    "duration_ms": 142.5,
    "input_size_bytes": 89,
    "input_type": "text",
    "ai_provider": "gemini"
  }
}

3. Analyze Log File

curl -X POST http://localhost:8000/api/analyze \
  -H "Content-Type: application/json" \
  -d '{
    "input_type": "log",
    "content": "[2024-03-26 12:34:56] ERROR: Failed login attempt from 192.168.1.100\n[2024-03-26 12:35:10] ERROR: Failed login attempt from 192.168.1.100\n[2024-03-26 12:35:24] ERROR: Failed login attempt from 192.168.1.100",
    "options": {
      "enable_log_analysis": true
    }
  }'

4. Check API Health

curl http://localhost:8000/api/health

Response:

{
  "status": "ok",
  "version": "3.0.0",
  "ai_providers": {
    "gemini": true,
    "claude": true,
    "fallback": true
  }
}

5. List Detection Patterns

curl http://localhost:8000/api/patterns

---

🧪 Testing

Run All Tests

cd backend
pytest -v

Run Specific Test Category

# Unit tests
pytest tests/unit/ -v

# Integration tests
pytest tests/integration/ -v

# With coverage
pytest --cov=app tests/

Test Key Features

# Test detection
test_regex_detector.py          # 18+ pattern detection
test_log_analyzer.py            # Log anomalies

# Test scoring
test_risk_scorer.py             # Risk calculation

# Test API
test_api_endpoints.py           # Full endpoint testing

---

📁 Project Structure

SISA_V3/
├── backend/
│   ├── app/
│   │   ├── api/
│   │   │   ├── routes/
│   │   │   │   └── analyze.py         # Core API endpoints
│   │   │   └── schemas.py             # Request/response models
│   │   ├── core/
│   │   │   ├── config.py              # Unified settings
│   │   │   ├── constants.py           # Patterns, weights, thresholds
│   │   │   └── exceptions.py          # Custom exceptions
│   │   ├── services/
│   │   │   └── analysis.py            # Main pipeline orchestrator
│   │   ├── processing/
│   │   │   ├── detectors/regex.py     # Sensitive data detection
│   │   │   ├── analyzers/log_analyzer.py  # Log analysis
│   │   │   ├── scorers/risk_scorer.py     # Risk calculation
│   │   │   └── policies/masker.py         # Masking engine
│   │   ├── ai/
│   │   │   └── provider.py            # Gemini, Claude, Fallback
│   │   └── parsers/document.py        # File parsing
│   ├── tests/
│   │   ├── unit/
│   │   └── integration/
│   ├── main.py                        # FastAPI entry point
│   ├── requirements.txt
│   └── Dockerfile
├── frontend/
│   ├── src/
│   │   ├── main.jsx
│   │   ├── App.jsx
│   │   ├── components/
│   │   │   ├── Header.jsx
│   │   │   ├── AnalyzeForm.jsx
│   │   │   ├── DropZone.jsx
│   │   │   ├── RiskGauge.jsx
│   │   │   ├── ResultsPanel.jsx
│   │   │   ├── FindingsList.jsx
│   │   │   ├── AnomaliesList.jsx
│   │   │   └── InsightsList.jsx
│   │   └── styles/
│   │       └── [CSS files]
│   ├── index.html
│   ├── package.json
│   ├── vite.config.js
│   └── Dockerfile
├── docker-compose.yml
├── vercel.json
├── .env.example
└── README.md

---

🔌 Configuration

All settings are in .env:

# AI Providers (at least one required)
GEMINI_API_KEY=your_key_here
ANTHROPIC_API_KEY=your_key_here

# Server
DEBUG=false                  # Dev/Prod
HOST=0.0.0.0
PORT=8000

# Features
ENABLE_AI_INSIGHTS=true
ENABLE_LOG_ANALYSIS=true
MAX_FILE_SIZE_MB=100

# Risk Thresholds
RISK_THRESHOLD_CRITICAL=80   # >= 80 = CRITICAL
RISK_THRESHOLD_HIGH=60       # >= 60 = HIGH
RISK_THRESHOLD_MEDIUM=40     # >= 40 = MEDIUM

---

🚀 Deployment

Vercel (Frontend)

cd frontend
npm run build
vercel deploy

AWS / Azure / GCP (Backend)

# Build Docker image
docker build -t sisa-backend:3.0.0 backend/

# Push to registry
docker push your-registry/sisa-backend:3.0.0

# Deploy (example: AWS ECS, Azure Container Instances, etc)

Self-Hosted

docker-compose up -d

# Production: Add reverse proxy (nginx) + SSL
# Add process manager (supervisor, systemd)
# Set up logging & monitoring

---

📈 Performance

• Detection: 18+ patterns scanned in <200ms
• Risk Scoring: Weighted calculation <50ms
• Log Analysis: IP tracking & anomaly detection
• AI Insights:
  • Gemini: ~1-2s
  • Claude: ~2-3s
  • Rule-based: <100ms (instant)
• Async/Await: Full async FastAPI pipeline
• Scalability: Stateless design, horizontal scaling ready

---

🔐 Security Notes

• Never commit .env files
• API keys should be in environment variables
• Use HTTPS in production
• Implement rate limiting for public APIs
• Regular dependency updates: pip install --upgrade -r requirements.txt
• Run security scans: pip install bandit && bandit -r app/

---

📝 API Endpoints

Method	Endpoint	Purpose
POST	/api/analyze	Analyze content for sensitive data
GET	/api/health	Health check & AI provider status
GET	/api/patterns	List available detection patterns
GET	/	API info & endpoints
GET	/docs	Interactive API documentation

---

🆘 Troubleshooting

Backend won't start

# Check Python version
python --version  # Requires 3.11+

# Check dependencies
pip install -r requirements.txt

# Check port conflict
lsof -i :8000  # macOS/Linux
netstat -ano | findstr :8000  # Windows

Frontend not loading

# Clear cache
rm -rf node_modules package-lock.json
npm install

# Check port 5173 available
npm run dev

AI provider errors

# Verify API keys in .env
# Test Gemini: https://makersuite.google.com/
# Test Claude: https://console.anthropic.com/

Docker issues

docker-compose down
docker-compose up --build --no-cache

---

📚 Documentation

• API Docs: http://localhost:8000/docs (Swagger UI)
• OpenAPI: http://localhost:8000/openapi.json
• Backend Code: See /backend/app/ for detailed comments
• Frontend Code: See /frontend/src/ for React components

---

🤝 Contributing

1. Create a feature branch
2. Follow code style (Black for Python, Prettier for JS)
3. Add tests for new features
4. Submit PR with description

---

📄 License

SISA V3 © 2024. All rights reserved.

---

❓ Support

For issues or questions:

1. Check the Troubleshooting section above
2. Review error logs: docker logs sisa-backend
3. Test API endpoints with provided curl examples
4. Check your API keys and environment configuration

---

SISA V3: Secure Data Intelligence Platform Built for enterprise security with AI-powered insights.