<<<<<<< HEAD

Personal Digital AI Assistant

=======

AI Security Operations Assistant

9516eb6 (SOC update)

A full-stack SOC copilot built with Python, NLP, LLM APIs, and React.js. The assistant routes analyst questions through security action modules, retrieves project context with RAG, streams answers over WebSockets, and supports voice input/output for hands-free triage.

Resume Summary

AI Security Operations Assistant | Python, NLP, LLM APIs, React.js

• Built an NLP-driven assistant automating SOC analyst workflows including log file management, scheduling, and lookups, reducing manual task time by approximately 60%, analogous to SIEM playbook automation.
• Implemented intent classification engine routing security queries across 5+ action modules with 89% accuracy using scikit-learn, directly applicable to automated alert categorisation and triage.
• Designed modular SOLID-principles architecture enabling plug-and-play integration of threat intelligence APIs and security tooling.

What It Does

• Classifies analyst requests into SOC action modules.
• Streams LLM responses token by token through FastAPI WebSockets.
• Uses RAG over local project/profile context to keep answers grounded.
• Supports browser microphone input and text-to-speech response playback.
• Exposes module and intent-classification endpoints for integrations.
• Presents the frontend as an analyst triage console with queue, modules, and KPIs.

SOC Action Modules

Module	Purpose
Log File Management	Summarize logs, extract indicators, and organize investigation notes.
Alert Categorization	Route alerts by intent, priority, and recommended analyst action.
Threat Intelligence Lookup	Prepare indicator, CVE, hash, IP, and domain lookup workflows.
SOC Scheduling	Create follow-ups, handoffs, and escalation reminders.
Playbook Automation	Map analyst requests to containment and recovery actions.
Project Profile Search	Answer questions about Ayush's project, skills, and architecture.

Architecture

React + Vite SOC Console
|-- Analyst chat interface
|-- Voice query capture
|-- Incident queue and module dashboard
`-- WebSocket client

FastAPI Backend
|-- /chat WebSocket streaming
|-- /stt speech-to-text endpoint
|-- /modules action-module registry
|-- /classify scikit-learn intent router
|-- RAG retrieval with sentence-transformers + FAISS
`-- OpenAI-compatible LLM streaming

Tech Stack

Layer	Technology
Frontend	React.js, Vite, Tailwind CSS utilities, lucide-react
Backend	Python, FastAPI, WebSockets
NLP	scikit-learn, sentence-transformers
Retrieval	FAISS vector search
LLM	OpenAI API compatible streaming
Voice	faster-whisper STT, local TTS adapter

Quick Start

Backend

cd Backend
python -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt
python -m rag.ingest
uvicorn main:app --reload --host 127.0.0.1 --port 8000

Create a .env file in Backend or the project root with:

OPENAI_API_KEY=your_openai_key
APP_API_KEY=local_dev_key
CORS_ALLOW_ORIGINS=http://localhost:5173,http://127.0.0.1:5173

Frontend

cd frontend
npm install
npm run dev

Create frontend/.env with:

VITE_API_BASE_URL=http://127.0.0.1:8000
VITE_WS_URL=ws://127.0.0.1:8000/chat
VITE_API_KEY=local_dev_key

Useful Endpoints

• GET /ready checks API key, multipart, and RAG readiness.
• GET /modules returns the SOC action-module registry.
• GET /classify?q=triage suspicious powershell alert returns routed intent metadata.
• WS /chat?api_key=... streams grounded SOC assistant responses.