How zhadyz/ai_soc works
AI-SOC is a local research security-operations platform. Wazuh alerts enter through a receiver, receive AI triage and knowledge enrichment, and can be correlated into incidents for analyst review or response planning; analysts can also review feedback and detection-rule drafts. The README documents the broader ML, simulation, retraining, and rollback capabilities. Edges reflect excerpted calls or documented service behavior; unsampled implementation details and wiring are not inferred.
Main entry points: app.py SOC Dashboard · llm_client.py Alert Triage · main.py Wazuh Receiver · api_security.py API Security
Components 24
Analyst Access
- SOC Dashboard
dashboard/app.py - Identity and Roles
dashboard/authentication.py
Alert Analysis
- Wazuh Receiver
services/wazuh-integration/main.py - Alert Triage
services/alert-triage/llm_client.py - Flow Inference
ml_training/inference_api.py - Local LLM
Knowledge and Learning
- Knowledge Retrieval
services/rag-service/main.py - Knowledge Base
services/rag-service/knowledge_base.py - Feedback and Reviews
services/feedback-service/main.py - Model Retraining
services/retraining/retrain.py
Incident Response
- Incident Correlation
services/correlation-engine/main.py - Attack Simulation
services/correlation-engine/simulator.py - Response Plans
services/response-orchestrator/orchestrator.py - Response API
services/response-orchestrator/main.py - Sigma Rule Workflow
services/rule-generator/main.py
Shared Services
- Token Identity
services/common/identity.py - API Security
services/common/api_security.py - Flow Schema
services/common/flow_schema.py - Service Integration
services/common/integration.py - Pipeline Orchestration
services/common/pipeline.py - Model Integrity
services/common/model_integrity.py - Rate Limiting
services/common/rate_limit.py - TLS Helpers
services/common/tls.py
Other components
- Analyst
Connections 28
- Analyst → SOC Dashboard: uses
README.md - SOC Dashboard → Identity and Roles: installs auth
dashboard/app.py - Identity and Roles → Token Identity: authenticates
dashboard/authentication.py - Identity and Roles → Rate Limiting: limits requests
dashboard/authentication.py - SOC Dashboard → Feedback and Reviews: proxies reviews
dashboard/app.py - SOC Dashboard → Sigma Rule Workflow: proxies rule review
dashboard/app.py - Wazuh Receiver → Alert Triage: queues alerts
README.md - Wazuh Receiver → Knowledge Retrieval: requests enrichment
services/wazuh-integration/main.py - Wazuh Receiver → Incident Correlation: submits enriched alerts
services/wazuh-integration/main.py - Alert Triage → Local LLM: analyzes alerts
services/alert-triage/llm_client.py - Alert Triage → Flow Inference: requests prediction
services/alert-triage/llm_client.py - Alert Triage → Knowledge Retrieval: retrieves context
services/alert-triage/llm_client.py - Knowledge Retrieval → Knowledge Base: retrieves documents
- SOC Dashboard → Incident Correlation: views incidents
README.md - SOC Dashboard → Response API: reviews plans
README.md - Incident Correlation → Response API: triggers defense
services/correlation-engine/main.py - Response API → Response Plans: dispatches plans
services/response-orchestrator/main.py - Response Plans → Attack Simulation: uses predictions
README.md - SOC Dashboard → Feedback and Reviews: submits analyst labels
README.md - Model Retraining → Flow Inference: promotes model bundle
README.md - Wazuh Receiver → API Security: protects API
services/wazuh-integration/main.py - Alert Triage → Flow Schema: validates flow inputs
- SOC Dashboard → API Security: uses service credentials
dashboard/app.py - API Security → Token Identity: verifies tokens
services/common/api_security.py - API Security → Rate Limiting: limits API calls
services/common/api_security.py - Pipeline Orchestration → Service Integration: uses clients
services/common/pipeline.py - Flow Inference → Model Integrity: verifies artifacts
ml_training/inference_api.py - Response Plans → TLS Helpers: uses Wazuh adapter