AI Security Log Auditor

prabanjan Sakthibabu — Tue, 25 Aug 2026 18:44:35 +0000

AI Security Log Auditor

Manual log triage takes 15+ minutes and misses stealthy bursts. This dashboard ingests raw Syslog/Nginx/auth.log/Suricata logs, redacts credentials client-side, clusters anomalies with lightweight heuristics, and streams structured threat JSON (threatLevel, attackVector, mitreTechniqueId, confidence, remediation) into an interactive cyber-terminal for instant iptables/fail2ban/nginx mitigations.

Live Demo: https://ai-security-auditor-one.vercel.app · Video: (Unlisted YouTube link) · Blog: (Dev.to/Hashnode link)

Architecture

flowchart LR
  A["Raw Logs<br/>Syslog / Nginx / auth.log"] --> B["Ingestion & Sanitization<br/>redact credentials<br/>cluster anomalies"]
  B --> C["Structured Prompt<br/>threatLevel, attackVector, mitreId"]
  C --> D["AI Inference<br/>Gemini Flash / Ollama"]
  D --> E["Risk & Remediation<br/>Health = 100 - C*25 - W*10"]
  E --> F["Angular Signals<br/>metrics / table / terminal"]
  F --> G["Dark Cyber UI"]

Pipeline highlight file mapping:

src/app/models/security.model.ts:1 — LogEntry, ThreatReport, MitreTechnique, RemediationAction, DashboardMetrics
src/app/services/log-generator.service.ts:32 — getAttackPresets() / getSampleLogsByPreset() / parseRawLogLines()
src/app/services/ai-auditor.service.ts:18 — ingestLogs() → mitreMap (T1110.001, T1190, T1046, T1078) + buildRemediation()
src/app/components/dashboard/dashboard.component.html:20 — metric bar, src/app/components/dashboard/dashboard.component.html:32 drag-drop zone (dragover)/(drop), src/app/components/dashboard/dashboard.component.html:145 remediation terminal

Tech Stack

Layer	Choice	Why
Frontend	Angular 17+ standalone, TypeScript, `CommonModule` + `FormsModule`	Reactive signals/services, strict types
Styling	Bootstrap 5.3 + SCSS (`src/app/app.scss:1`, `src/app/components/dashboard/dashboard.component.scss:1`)	Terminal dark theme `#0a0f1d`, `#1e293b` cards, glowing badges
Icons	Font Awesome 4.7 (`angular.json:36`)	`fa-shield`, `fa-terminal`, `fa-bug`
AI	Gemini 2.0 Flash (cloud) / Ollama Llama 3.1 8B local	Spec schema: `threatLevel`/`attackVector`/`mitreTechniqueId`/`confidenceScore`/`remediationCommands` — fallback heuristic already ships
Build	Angular CLI `ng build` / `ng test` (Vitest)	`angular.json:43` budgets `700kB/14kB`

Recommended models per spec: Gemini 2.0 Flash (1M context, sub-second) for hosted; Ollama (Qwen 2.5 Coder) for air-gapped — logs never leave browser.

Features

Ingestion: drag-drop, browse, 6 presets (Full 49 / SSH 15 / SQLi 8 / Recon 5 / API 1 / Clean 20), paste raw text — all via src/app/components/dashboard/dashboard.component.ts:55 onDragOver/onDrop/handleFile
Sanitization: client-side redaction before any AI call (sanitizedTokensCount in header)
Metrics: Total Ingested / Critical / Warning / Health 100-(C×25+W×10) with conic ring healthColor()
Threat Intel: filterable table (search IP/vector/MITRE, severity & vector dropdown) — selectable row opens inspector with aiAnalysis, MITRE link, IoCs, raw redacted line
Terminal: per-threat iptables/fail2ban/ufw/nginx with Copy, Run (Sim), Copy All, Export .sh (downloadScript()), simulated stdout

Quick Start

# prerequisites: Node 20+, npm 10+
git clone https://github.com/prabanjan127/ai-security-auditor.git
cd ai-security-auditor
npm install          # installs bootstrap@5.3.8 + font-awesome@4.7.0 per angular.json:33
ng serve             # http://localhost:4200 — dashboard auto-loads Full Attack Suite
ng test              # 2/2 passing (src/app/app.spec.ts:1)
npm run build        # → dist/ai-security-auditor/browser/

Try it:

Click Load Sample Attack Logs or any preset pill.
Or drop a .log (e.g. auth.log with Failed password for invalid user admin from 203.0.113.5).
Filter by CRITICAL, search 203.0.113, select a row → copy sudo iptables -A INPUT -s 203.0.113.5 -p tcp --dport 22 -j DROP from terminal.

Deploy

Vercel (recommended)

npm i -g vercel
vercel --prod  # uses vercel.json (output: dist/ai-security-auditor/browser)

vercel.json already contains SPA rewrite /(.*) → /index.html.

Netlify / GitHub Pages

npm run build
# Netlify: drag dist/ai-security-auditor/browser
# GH Pages: npx angular-cli-ghpages --dir=dist/ai-security-auditor/browser

Project Links (replace before submit)

GitHub: https://github.com/prabanjan127/ai-security-auditor
Live Demo: https://ai-security-auditor-one.vercel.app
Blog (Dev.to/Hashnode): paste draft from prompt + screenshots above
Video (Unlisted YouTube): 0:00 problem / 0:30 upload demo / 1:30 architecture

How It Works (for blog/video)

Ingest — drop .log → LogGeneratorService.parseRawLogLines() clusters anomalies.
Sanitize — sanitizeLine() redacts Bearer/api_key before inference.
Infer — structured prompt expects {threatLevel, attackVector, mitreTechniqueId, confidenceScore, remediationCommands}.
Score — calculateDashboardMetrics() → health.
Display — DashboardComponent binds via applyFilters() / selectReport(); terminal streams terminalOutput[].

License

MIT — showcase project; not for production firewall automation without review.

DEV Community: prabanjan Sakthibabu

AI Security Log Auditor

AI Security Log Auditor

Architecture

Tech Stack

Features

Quick Start

Deploy

Vercel (recommended)

Netlify / GitHub Pages

Project Links (replace before submit)

How It Works (for blog/video)

License