LogChecker: Autonomous Security Incident Response Agent 🛡️

LogChecker is a multi-agent AI system designed to automate Tier-1 SOC (Security Operations Center) analysis. It autonomously parses raw server logs, identifies attack patterns, and correlates findings with threat intelligence logic to generate actionable incident reports.

🚀 Key Features

• Multi-Agent Architecture: Uses specialized AI agents ("Analyst" and "Researcher") that collaborate to solve complex security tasks.
• Automated Forensics: Detects brute-force attacks, unauthorized root access, and suspicious command execution.
• Context-Aware Reasoning: Distinguishes between internal (lateral movement) and external threats based on IP ranges.
• Local LLM Support: Optimized to run on private infrastructure (School/Enterprise Servers) via LiteLLM and Mistral.

🧠 System Architecture

The system utilizes the CrewAI framework to orchestrate the following workflow:

1. Ingestion: Raw logs (SSH, Auth) are fed into the system.
2. Agent 1: The Log Analyst:
   • Role: Pattern recognition and anomaly detection.
   • Output: A technical summary of the breach (timestamps, IPs, methods).
3. Agent 2: The Threat Researcher:
   • Role: Contextualization and severity assessment.
   • Action: Takes the Analyst's findings, evaluates the IP reputation (Internal vs. External), and maps behaviors to potential intent.
4. Reporting: Generates a comprehensive "Defense Brief" with remediation steps.

🛠️ Tech Stack

• Language: Python 3.13
• Orchestration: CrewAI (Agents, Tasks, Process)
• LLM Interface: LiteLLM (OpenAI-compatible protocol)
• Model: Mistral-Small-3.2-24B-Instruct (Hosted Locally)

📂 Project Structure

LogChecker/
├── src/
│   ├── agents.py      # Agent Definitions (Analyst & Researcher)
│   ├── tasks.py       # Task Instructions & Expected Outputs
│   └── main.py        # Orchestration Entry Point
├── data/              # Log samples and datasets
├── .env               # API Keys and Endpoint Configuration
└── requirements.txt   # Python dependencies