AI-Driven SIEM Prototype

A compact Security Information and Event Management prototype for ingesting simulated security logs, applying interpretable detection rules, and surfacing enriched alerts in a browser dashboard.

This version is intentionally dependency-light for a timed challenge: the backend uses Python standard library modules, SQLite, and a small HTTP API. The dashboard is plain HTML, CSS, and JavaScript.

Features

• JSON log ingestion with schema validation
• SQLite event and alert storage
• Detection rules for:
  • Brute-force login attempts
  • Privilege escalation
  • Port scanning
  • Possible data exfiltration
• AI-style alert enrichment with clear severity, rationale, recommended actions, and investigation questions
• Optional model integration hook via environment variables
• Browser dashboard with event feed, alert board, status updates, filters, and summary metrics
• Unit tests for ingestion, detection, and API behavior

Quick Start

cd siem-ai-prototype
python backend\main.py

Open http://localhost:5000.

The server initializes the database and ingests data/sample_events.json automatically when the database is empty.

API

GET  /api/events
POST /api/events/ingest
GET  /api/alerts
POST /api/alerts/enrich
PUT  /api/alerts/{alert_id}/status
GET  /api/stats/summary

Ingest Event Schema

{
  "timestamp": "2026-05-11T10:57:00Z",
  "event_type": "login_attempt",
  "source_ip": "203.0.113.10",
  "username": "admin",
  "status": "failed",
  "destination_port": 22,
  "bytes_out": 0,
  "additional_context": {}
}

POST /api/events/ingest accepts either a JSON array or an object with an events array.

Detection Rules

Rule	Logic	Default Severity
Brute force login	5+ failed logins from the same source IP in 10 minutes	High
Privilege escalation	Any privilege change or sudo-like event with suspicious context	High
Port scan	20+ distinct destination ports from one IP in 5 minutes	Medium
Data exfiltration	Large outbound transfer to an external IP	Critical

Rules are intentionally simple and explainable, which is usually better for a small SIEM prototype than opaque scoring.

AI Enrichment

backend/ai_enrichment.py provides deterministic enrichment so the prototype works without paid credentials. It returns:

• Severity review
• Likely attack type
• Human-readable rationale
• Recommended actions
• Follow-up questions for the analyst

If integrating a hosted model later, keep the same function boundary and replace the local heuristic branch with a real API call. The .env.example file includes the expected environment variables.

Tests

python -m unittest discover -s tests -v

Project Structure

backend/
  ai_enrichment.py
  database.py
  detection_engine.py
  log_ingestion.py
  main.py
  generate_sample_data.py
data/
  sample_events.json
frontend/
  dashboard.js
  index.html
  style.css
tests/
  test_api.py
  test_detection.py
  test_ingestion.py
NOTES.md

Prototype Caveats

• No authentication or multi-user authorization.
• Rules are in code rather than editable from the UI.
• The local enrichment is intentionally deterministic for repeatable demos.
• SQLite is appropriate for the prototype, not a high-volume production SIEM.
• Event correlation is limited to simple time windows.