Why I built this
For Graph Hacks: Context for AI Agents, I wanted to build something practical around graph databases instead of just reading about them. I decided to try a cybersecurity investigation tool because investigating suspicious activity often means connecting the dots between accounts, devices, servers, and alerts.
That's how GraphSleuth AI came together.
GitHub: https://github.com/GouravGC/GraphSleuth-AI
What does it do?
Imagine you're looking into a suspicious user account. You might want to know which device it accessed, which server that device connected to, and whether any security alerts are related.
Looking at those details separately doesn't always make the bigger picture obvious. GraphSleuth AI lets you explore these connections through a graph.
I built the prototype with Python, Streamlit, and FalkorDB. The application uses Cypher queries to trace account-to-device-to-server paths, connect relevant alerts, and display the evidence found in the graph.
The project currently uses synthetic cybersecurity data, so it's a prototype rather than a tool intended for real security investigations.
Where FalkorDB fits in
FalkorDB isn't just there to draw a graph. It's the database behind the investigation logic.
I represent entities such as accounts, devices, servers, and alerts as nodes, with relationships connecting them. Then I use Cypher queries to follow those relationships and retrieve connected evidence.
That was the interesting part for me: instead of looking at each record in isolation, I could explore how several entities were connected through multiple steps.
The tech stack
Here's what I used:
- Python for the application logic
- FalkorDB for storing and querying the graph
- Cypher for traversing relationships
- Streamlit for the interface
- Docker Compose to run FalkorDB locally
I kept the setup local and documented the steps in the repository README.
A few things I learned
One thing that stood out to me was how much the graph model matters. You need to think about which entities belong in the graph and what their relationships actually mean. Otherwise, even a working query won't give you useful investigation results.
I also got a practical reminder that running an app locally and deploying it to the cloud are different challenges. If the database is running on your own machine, a cloud-hosted interface can't automatically connect to it.
There is still plenty I'd like to improve, including adding more investigation scenarios, expanding the tests, and eventually exploring a proper remote deployment.
What's next?
GraphSleuth AI is an early prototype, and I don't want to present it as a finished cybersecurity product. For now, it demonstrates one idea: graph relationships can help make investigation paths easier to follow and explain.
If you'd like to explore the code, here's the repository:
https://github.com/GouravGC/GraphSleuth-AI
This was my project for Graph Hacks: Context for AI Agents, organized by WeMakeDevs and FalkorDB. Building it gave me a more practical understanding of how graph databases can be used beyond simple visualization.
Top comments (0)