🛡️ Multi-Agent SOC (Security Operations Center)

An autonomous, LLM-powered Security Operations Center built with CrewAI, ChromaDB, and Streamlit. Detects, investigates, and triages cybersecurity incidents using a pipeline of specialized AI agents — with a human-in-the-loop approval gate for high-severity alerts.

🏗️ Architecture

Log Sources (Zeek / Syslog / Windows Events)
            ↓
      ingestor.py
    (ML classification + ChromaDB vector store)
            ↓
     pipeline_runner.py
    (polls for new high-severity alerts every 60s)
            ↓
      orchestrator.py
    ┌─────────────────────────────────────────┐
    │  Phase 1 — Triage                       │
    │  assign_severity() → attack type + score│
    │                                         │
    │  Phase 2 — Threat Hunting               │
    │  query_vector_db() → related logs       │
    │  mitre_lookup()    → ATT&CK mapping     │
    │  enrich_ioc()      → AbuseIPDB + VT     │
    │                                         │
    │  Phase 3 — Forensics                    │
    │  timeline_reconstruct() → event chain   │
    │  lateral_movement_check() → spread      │
    │                                         │
    │  Phase 4 — ReporterAgent (CrewAI LLM)  │
    │  → Structured Markdown incident report  │
    └─────────────────────────────────────────┘
            ↓ severity >= 8?
      hitl_queue.db (SQLite HITL gate)
            ↓
      dashboard.py (Streamlit)
    ┌──────────────────────────────┐
    │  🔴 Pending Approvals        │
    │  📋 Alert History            │
    │  📊 SOC Metrics              │
    └──────────────────────────────┘

🤖 Agents

| Agent | Role | Tools | |---|---|---| | TriageAgent | Classifies attack type and severity score | assign_severity | | HunterAgent | Semantic log search + IOC enrichment + MITRE mapping | query_vector_db, enrich_ioc, mitre_lookup | | ForensicsAgent | Attack timeline reconstruction + lateral movement detection | timeline_reconstruct, lateral_movement_check | | ReporterAgent | Synthesizes all findings into a structured incident report | None (reasoning only) |

🧰 Tech Stack

| Component | Technology | |---|---| | Agent Framework | CrewAI + Ollama (llama3.1 — fully local) | | Vector Database | ChromaDB (semantic log search) | | ML Classifier | Random Forest trained on NSL-KDD dataset | | Threat Intelligence | AbuseIPDB API + VirusTotal API | | Threat Knowledge Base | MITRE ATT&CK Enterprise (local JSON) | | HITL Queue | SQLite | | Analyst Dashboard | Streamlit | | Log Sources | Zeek, Syslog, Windows Event Logs |

🚀 Setup

1. Clone and install dependencies

git clone https://github.com/Atharva2410/multiagentsoc.git
cd multiagentsoc
python -m venv soc_venv
soc_venv\Scripts\activate
pip install -r requirements.txt

2. Start Ollama with llama3.1

ollama pull llama3.1
ollama serve

3. Download MITRE ATT&CK data

iwr "https://raw.githubusercontent.com/mitre/cti/master/enterprise-attack/enterprise-attack.json" -OutFile "mitre_attack.json"

4. Add API keys

Create a .env file:

ABUSEIPDB_API_KEY=your_abuseipdb_key_here
VIRUSTOTAL_API_KEY=your_virustotal_key_here

5. Generate logs and ingest

python log_generator.py
python ingestor.py

6. Run the pipeline

python orchestrator.py
# or continuous mode:
python pipeline_runner.py

7. Launch the dashboard

streamlit run dashboard.py

📊 Dashboard Features

• Pending Approvals — review reports, approve/reject/escalate alerts
• Alert History — full audit trail with analyst + timestamp
• SOC Metrics — KPIs, attack distribution, MTTR, false positive rate

🔬 ML Classification Model

Random Forest trained on NSL-KDD dataset:

| Category | Description | |---|---| | normal | Legitimate traffic | | dos | Denial of Service | | probe | Network reconnaissance | | r2l | Remote to Local | | u2r | User to Root — privilege escalation | | lateral_movement | SMB/RDP spread (T1021) | | c2_beacon | Command & Control | | ssh_bruteforce | Brute force over SSH | | port_scan | Network discovery (T1046) |

🗂️ Project Structure

multiagentsoc/
├── soc_agents/
│   ├── triage_agent.py
│   ├── hunter_agent.py
│   ├── forensics_agent.py
│   └── reporter_agent.py
├── tools/
│   └── agent_tools.py
├── memory/
│   └── chroma_store.py
├── hitl/
│   ├── queue_manager.py
│   └── auto_response.py
├── orchestrator.py
├── pipeline_runner.py
├── dashboard.py
├── metrics.py
├── ingestor.py
├── log_generator.py
└── requirements.txt

🔑 Key Design Decisions

Why pre-run tools instead of full ReAct? Local LLMs (llama3.1 8B) loop on multi-tool tasks. Pre-executing deterministic tools in Python and injecting structured results makes the pipeline reliable without a 70B model.

Why ChromaDB? Enables semantic log search — finds related events even with different phrasing, unlike exact-match SIEM queries.

Why SQLite for HITL? Zero-config and portable. Production would use Redis/RabbitMQ with auto-escalation timeouts.

🛣️ Roadmap

• [ ] Real Zeek log ingestion from Kali VM
• [ ] Slack/email notifications for approvals
• [ ] Auto-escalation after 30min timeout
• [ ] Docker Compose deployment
• [ ] Real firewall API (pfSense/iptables)

📄 License

MIT

👤 Author

Built by Atharva Amle — GitHub: Athar2410