How cyberrksha/edgerksha works
This repository is an edge-focused autonomous SOC research stack: Wazuh collects and alerts on telemetry, perimeter defenses expose attack activity, and AI triage can analyze alerts and trigger guarded response. The clearest live path is the integration triage script, which gathers WAF and honeypot logs and calls the AI analyst; the SOC daemon separately polls Wazuh and can invoke active response. The README also documents phishing analysis, evaluation, integrity checking, benchmarks, and a demo dashboard. Some subsystems are represented by their exact directories because their implementation was not sampled.
Main entry points: soc_daemon.py SOC Daemon · ai_analyst.py AI Analyst · triage_live_logs.py Live Log Triage · app.py Phishing Analyzer
Components 26
Perimeter Defense
- ModSecurity WAF
project-4-waf - Cowrie Honeypot
project-5-honeypot
SIEM and Triage
- Wazuh SIEM
project-1-siem/docker/docker-compose.yml - Detection Rules
project-1-siem/wazuh_rules - Attack Parser
project-1-siem/src/attack_parser.py - Alert Client
project-2-soc-bot/src/alert_parser.py - SOC Daemon
project-2-soc-bot/src/soc_daemon.py - AI Analyst
project-2-soc-bot/src/ai_analyst.py - Active Response
project-2-soc-bot/src/active_response.py - Triage Reports
project-2-soc-bot/src/soc_daemon.py - Log Integrity
project-2-soc-bot/src/hash_chain.py - MITRE Audit
project-2-soc-bot/src/hallucination_checker.py
Analysis Tools
- Phishing Analyzer
project-3-phishing-analyzer/src/app.py - Email Features
project-3-phishing-analyzer/src/email_parser.py - AI Explainer
project-3-phishing-analyzer/src/ai_explainer.py - Explainability Audit
project-3-phishing-analyzer/src/explainability_audit.py - Model Training
project-3-phishing-analyzer/src/train_models.py - SOC Evaluation
project-2-soc-bot/src/evaluation_harness.py - Synthetic Alerts
project-2-soc-bot/src/augment_dataset.py
Integration and Demo
- Live Log Triage
project-11-integration/triage_live_logs.py - Kill-Chain Demo
project-11-integration/simulate_killchain.py - Showcase Dashboard
project-12-showcase/app.py - Resource Benchmarks
project-6-benchmarks/src
Other components
- Operator
- LLM Providers
- Wazuh API
Connections 27
- Operator → Phishing Analyzer: uploads email
project-3-phishing-analyzer/src/app.py - Phishing Analyzer → Email Features: extracts features
project-3-phishing-analyzer/src/app.py - Phishing Analyzer → AI Explainer: requests explanation
project-3-phishing-analyzer/src/app.py - Explainability Audit → Email Features: extracts features
project-3-phishing-analyzer/src/explainability_audit.py - Explainability Audit → AI Explainer: explains errors
project-3-phishing-analyzer/src/explainability_audit.py - Operator → SOC Daemon: runs monitoring
README.md - SOC Daemon → Alert Client: fetches alerts
project-2-soc-bot/src/soc_daemon.py - SOC Daemon → AI Analyst: submits alerts
project-2-soc-bot/src/soc_daemon.py - AI Analyst → LLM Providers: queries provider
project-2-soc-bot/src/ai_analyst.py - SOC Daemon → Active Response: invokes conditionally
project-2-soc-bot/src/soc_daemon.py - Active Response → Wazuh API: requests firewall drop
project-2-soc-bot/src/active_response.py - SOC Daemon → Triage Reports: appends results
project-2-soc-bot/src/soc_daemon.py - Alert Client → Wazuh API: queries alerts
project-2-soc-bot/src/alert_parser.py - Detection Rules → Wazuh SIEM: configures detection
README.md - Wazuh SIEM → Alert Client: exposes alerts
README.md - Live Log Triage → ModSecurity WAF: reads container logs
project-11-integration/triage_live_logs.py - Live Log Triage → Cowrie Honeypot: reads event log
project-11-integration/triage_live_logs.py - Live Log Triage → AI Analyst: submits combined alert
project-11-integration/triage_live_logs.py - Operator → Kill-Chain Demo: runs simulation
README.md - Operator → Showcase Dashboard: launches demo
README.md - Operator → SOC Evaluation: runs evaluation
README.md - SOC Evaluation → AI Analyst: evaluates analyses
project-2-soc-bot/src/evaluation_harness.py - SOC Evaluation → Synthetic Alerts: uses generated alerts
project-2-soc-bot/src/evaluation_harness.py - Operator → Log Integrity: builds integrity chain
README.md - Operator → MITRE Audit: checks MITRE claims
README.md - Operator → Resource Benchmarks: measures footprint
README.md - Operator → Model Training: trains classifier