Logs in, analysis done, response playbook out.
CribEyes is a local autonomous cyber incident response tool that ingests telemetry SIEM and EDR systems to detect anomalous behavior and generate automated incident response guidance. The system normalizes heterogeneous security logs into the ECS format to enable unified analysis across endpoint, identity, cloud, and network domains.
A feature engineering pipeline converts normalized events into behavioral vectors representing entities such as users, hosts, IP addresses, etc. These vectors are processed using anomaly detection models to identify statistically significant outliers indicative of potential threats. Multi dimensional clustering is done by kill chain coherence based off of a calculated coherence score.
Detected anomalies are enriched with threat intelligence and mapped to adversary behaviors using MITRE ATT&CK. LLM powered agents then produces contextualized response action plans aligned with SOC best practices. The platform is designed to be SIEM-agnostic, scalable to high-volume telemetry, and secure for sensitive log processing, making it suitable for modern Security Operations Centers seeking AI-assisted detection and triage.
All the directories and sub directories have their own README files. Please refer to them.
Contains all the backend code.
Contains important reference scripts that were used to build the backend.
Contains a assorted diverse subset of splunk attack logs. Should be good enough for our purposes. Feel free to inspect it and provide suggestions to improve it.
Go into backend
- Run
docker compose up -d - Run
uv run uvicorn main:app --host 0.0.0.0 --port 8000 - Test out the bruno API's to see if its working.
- Ingest testing I used, logs_corpus/structured/cloud/datasets/attack_techniques/T1078/aws_createaccesskey/aws_cloudtrail_events.json
- Clearing it use the
uv run reference_scripts/ecs_clear.py
Go into frontend
npm run dev