How manashbajpai8840-alt/ai-soc-simulator works
AI SOC Simulator generates synthetic security events, filters them with heuristic rules, sends flagged events for AI or mock triage, and applies a confidence-gated response. Confirmed incidents can produce forensic reports; events, verdicts, and blocks are stored in SQLite for the live dashboard. The main workflow and dashboard reads are supported by sampled source. The README documents the broader capabilities; live system actions and Claude calls are optional integrations.
Main entry points: main.py Pipeline Orchestrator · responder.py Response Actions · db.py SQLite Access Layer · config.py Runtime Configuration
Components 14
Event Simulation
- Synthetic Log Generator
ai_soc_simulator/log_generator.py
Detection And Triage
- Pipeline Orchestrator
ai_soc_simulator/main.py - Heuristic Prefilter
ai_soc_simulator/detector.py - AI / Mock Triage
ai_soc_simulator/ai_analyzer.py - Runtime Configuration
ai_soc_simulator/config.py
Response And Evidence
- Response Actions
ai_soc_simulator/responder.py - Forensic Reports
Persistence And Dashboard
- SQLite Access Layer
ai_soc_simulator/db.py - SQLite Database
- Live Dashboard
ai_soc_simulator/dashboard.py
Other components
- Operator
- Claude API
- Host Firewall
- Host Processes
Connections 23
- Operator → Pipeline Orchestrator: starts simulator
- Operator → Live Dashboard: opens dashboard
- Pipeline Orchestrator → Synthetic Log Generator: requests event
- Synthetic Log Generator → Pipeline Orchestrator: returns event
- Pipeline Orchestrator → Heuristic Prefilter: checks event
- Pipeline Orchestrator → SQLite Access Layer: records event
- Pipeline Orchestrator → SQLite Access Layer: checks block status
- Pipeline Orchestrator → AI / Mock Triage: triages flagged event
- AI / Mock Triage → Claude API: requests analysis
- Pipeline Orchestrator → SQLite Access Layer: saves verdict
- Pipeline Orchestrator → Response Actions: dispatches response
- Pipeline Orchestrator → Response Actions: creates incident report
- Response Actions → Host Firewall: applies IP rule
- Response Actions → Host Processes: sends SIGSTOP
- Response Actions → Forensic Reports: writes report
- Pipeline Orchestrator → SQLite Access Layer: saves response and block
- Live Dashboard → SQLite Access Layer: reads stats and events
- SQLite Access Layer → SQLite Database: reads and writes
- Pipeline Orchestrator → Runtime Configuration: reads settings
- AI / Mock Triage → Runtime Configuration: reads model settings
- Heuristic Prefilter → Runtime Configuration: reads thresholds
- Response Actions → Runtime Configuration: reads report settings
- Live Dashboard → Runtime Configuration: reads display settings