Skip to content

NullShift v0.1.0 — Initial Public Release

Latest
Latest

Choose a tag to compare

View all tags
@hegazi-sec hegazi-sec released this 14 Jun 14:45
v0.1.0
00efa41

🎉 NullShift is live

The first public release of NullShift — an AI-powered triage assistant for L1 SOC analysts.

What's in the box

  • 🧠 12 LLM providers — Claude Agent SDK (use your Claude subscription, no API key), cloud APIs (Anthropic, OpenAI, Gemini, Groq, xAI, DeepSeek, Perplexity, OpenRouter, Qwen, Kimi), or fully local Ollama — even hosted on another machine over Tailscale.
  • 🔌 5 SIEM connectors — Wazuh, LimaCharlie, Splunk, Elastic, Microsoft Sentinel.
  • 📚 RAG over 753+ playbooks — Anthropic-Cybersecurity-Skills corpus bundled (skills + MITRE ATT&CK mappings), plus 4 NullShift-specific top-level playbooks.
  • 📋 Structured investigation reports — SECTION 1 (evidence) → SECTION 2 (reasoning) → SECTION 3 (verdict + confidence).
  • 🎯 L1 → L2 handoff mode — ticket-ready escalation summaries on demand.
  • 🔧 Admin UI with live SIEM test, drag-and-drop LLM provider chain, per-user temperature slider, conversation search, verdict badges, debug traces.
  • 💻 nullshift CLI — start / stop / restart / status / logs / setup.
  • ⚡ Single-command setup — python setup.py handles venv, dependencies, JWT, admin account, SIEM, RAG, and starts the server.

Connector maturity

Status Connector
✅ Production-ready Wazuh, Splunk
🧪 Beta — under active testing LimaCharlie, Elasticsearch, Microsoft Sentinel

Get started

git clone https://github.com/hegazi-sec/nullshift.git
cd nullshift
python setup.py

Then open http://localhost:58443.

Credits

Knowledge base powered by Anthropic-Cybersecurity-Skills by Mahipal (mukul975) — Apache 2.0.

— Ahmed Hegazi

Assets 2
Loading