AI-SOC Platform 🛡️

An AI-driven Security Operations Centre (SOC) simulation platform built with industry-standard open source tools. Demonstrates the full incident response lifecycle from attack simulation through detection, triage, investigation, and executive reporting.

Architecture

Attack Simulation → Wazuh SIEM → Alert Detection → SOC Dashboard
                                                  → AI Analysis (Groq LLaMA)
                                                  → Case Management (TheHive)
                                                  → Executive Report Generation

Stack

Component	Tool	Purpose
SIEM	Wazuh 4.8.0	Log ingestion, rule matching, alert generation
Case Management	TheHive 5	Incident tracking and workflow
AI Analysis	Groq (LLaMA 3.3 70B)	Alert classification and summary
Dashboard	React + Node.js	Unified analyst interface
Log Storage	OpenSearch	Alert indexing and search

Features

• 🎯 Attack Simulation — Phishing, ransomware, brute force, lateral movement, data exfiltration
• 🔍 Real-time Detection — Wazuh rules and decoders processing syslog events
• 🤖 AI-Assisted Triage — Per-alert AI analysis and classification via Groq LLM
• 📋 Case Management — Full TheHive integration with create/investigate/resolve/delete workflow
• 📊 Executive Reports — AI-generated incident timeline and stakeholder summary
• 📱 Responsive UI — Works on desktop and mobile

Setup

Prerequisites

• Docker Desktop (8GB RAM recommended)
• Groq API key (free at console.groq.com)

Installation

git clone https://github.com/YOUR_USERNAME/ai-soc-platform.git
cd ai-soc-platform
cp .env.example .env
# Edit .env with your API keys
docker compose up -d

Startup Sequence

docker compose up -d
sleep 90

# Required after every restart
docker exec wazuh-manager bash -c \
  "touch /var/ossec/etc/client.keys && \
   chmod 640 /var/ossec/etc/client.keys && \
   chown root:wazuh /var/ossec/etc/client.keys"

curl -sk -u admin:admin -X PUT 'https://localhost:9200/_cluster/settings' \
  -H 'Content-Type: application/json' \
  -d '{"persistent":{"compatibility.override_main_response_version":true,"action.auto_create_index":"true"}}'

Access

Service	URL	Credentials
SOC Dashboard	http://localhost:3000	—
Wazuh Dashboard	http://localhost:5601	admin / admin
TheHive	http://localhost:9000	admin@soc.local / admin1234

Workflow

Simulate Attack → Alert Generated → Expand Alert → AI Analyse
→ Create Case (TheHive) → Investigate → Resolve → Generate Report

Skills Demonstrated

• Security Operations (SIEM, SOAR, Case Management)
• AI/LLM Integration (Groq API, prompt engineering)
• Full-stack Development (React, Node.js, REST APIs)
• DevOps (Docker Compose, multi-container networking)
• Cloud Infrastructure (Oracle Cloud / ngrok deployment)