🛡️ AegisLog SIEM & Firewall Assistant

AegisLog is an AI-powered Security Information and Event Management (SIEM) and automated defense system. It ingests Linux authentication logs (auth.log), Snort IDS, and Suricata event streams (eve.json), detects brute-force attacks and user enumeration attempts, and enforces automated kernel-level IP blocking via iptables/ufw.

It includes an interactive UNIX-like CLI console and integrates with Google Gemini AI to act as a virtual SOC Analyst offering real-time threat intelligence and MITRE ATT&CK mapping.

---

✨ Key Features

1. 🔍 Multi-Format Log Parsing Engine

• Linux auth.log: Parses failed passwords, invalid users, SSH preauth disconnects, root/admin probes, sudo privilege escalations, and successful logins.
• Snort IDS/IPS: Detects ET SCAN Potential SSH Scan, GPL ATTACK_RESPONSE, SQL injection signatures, and privilege escalation alerts.
• Suricata Engine: Ingests eve.json and fast.log security events natively.
• Sample Scenarios: Drag-and-drop support for .log, .txt, or .json files alongside pre-loaded attack scenarios.

2. ⚡ Automated Anomaly & Brute-Force Detection

• Threat Analytics: Tracks failure frequency per source IP, targeted accounts (root, admin, postgres, oracle), and port sweeping behaviors.
• Risk Scoring (0–100): Evaluates threat severity using customizable thresholds for dictionary attacks and username enumeration.
• GeoIP & ASN Intelligence: Enriches attacker profiles with geographical origin and ISP/ASN details.

3. 🛑 Automated Response & Mitigation

• Kernel-Level Auto-Ban: Automatically generates iptables -A INPUT -s <IP> -j DROP rules for source IPs exceeding failure thresholds.
• Live Packet Counter: Simulates real-time packet drops and byte counts for blocked IP addresses.
• Multi-Format Export Options:
  • Ready-to-run apply_iptables.sh Bash scripts.
  • UFW rules (sudo ufw deny from <IP>).
  • /etc/iptables/rules.v4 static tables (iptables-save/restore).
  • Fail2ban jail.local configuration templates.

4. 💻 Interactive SIEM CLI Console

Emulates a real UNIX terminal experience with built-in commands:

• status: View global analysis and rule status.
• threats: List all detected attacker IPs.
• iptables -L -n -v: Inspect live simulated firewall tables.
• ban <IP> & unban <IP>: Instantly block or unblock IP addresses.
• autoban: Trigger bulk firewall rules for all IPs exceeding threat thresholds.
• investigate <IP>: Perform deep forensic analysis on a specific IP.
• export [sh|ufw|save]: Output firewall rule sets in your preferred format.
• ask <question>: Query the AI SOC Analyst directly from the command line.

5. 🤖 Gemini AI SOC Analyst

• Automated Forensic Analysis: Powered by Google Gemini API to deliver instant incident investigation reports.
• MITRE ATT&CK Mapping: Automatically maps attack patterns to specific techniques (e.g., T1110 - Brute Force, T1078 - Valid Accounts).
• Hardening Recommendations: Provides actionable SSH configuration (sshd_config) hardening guides and remediation steps.

---

🚀 Quick Start

Prerequisites

• Node.js 18+
• Google Gemini API Key (Get your API Key from Google AI Studio)

Installation

1. Clone the Repository:

   git clone [https://github.com/YOUR_USERNAME/aegislog-siem.git](https://github.com/YOUR_USERNAME/aegislog-siem.git)
   cd aegislog-siem