Network security monitoring · College capstone

AutoDefender

AutoDefender started as my capstone project in my senior year of college (fall 2025), and I still maintain it. It monitors Suricata network logs in real time or analyzes historical log files, maps each threat to MITRE ATT&CK, explains it in plain English with a local AI model through Ollama, and recommends responses, including firewall rules that only run after a person approves them.

GitHub Try it on Streamlit

Screenshots

Threat Analysis page with severity filters, threat counts and a table of threats with MITRE ATT&CK techniques

1 / 7

Threat Analysis

Filter threats by severity, IP address, date or text. Each one is tagged with its MITRE ATT&CK technique, and filtered results export to CSV or JSON.

Real-Time Security Dashboard monitoring a Suricata log, with threat metrics and a severity chart

2 / 7

Real-time monitoring

The dashboard watches one or more Suricata eve.json logs and updates its metrics and charts as new events arrive.

Threat details for an SSH brute force alert with MITRE ATT&CK mapping, AI analysis and executed actions

3 / 7

Threat details with an AI explanation

A critical SSH brute-force alert with its ATT&CK technique (T1110), a plain-English explanation from the local AI model, and the response actions taken.

Incidents page grouping threats by source IP with severity, duration and ATT&CK tactics

4 / 7

Incidents

Threats from the same source are grouped into one incident until that source goes quiet, so you can follow what one attacker did instead of reading alerts one at a time.

Action Management page with notify, log, Suricata drop rule and alert actions waiting for approval

5 / 7

Actions wait for approval

Recommended responses can be executed, approved or rejected. The Suricata drop rule targets exactly one source IP.

Suricata integration settings with dry-run mode on and automatic rule writing off

6 / 7

Safety controls

Rule management starts in dry-run mode, warns that drop rules only block traffic when Suricata runs inline, and won't write AI-suggested rules without asking unless you turn that on.

Audit Log page showing an integrity check that passed

7 / 7

Tamper-evident audit log

Sign-ins, approvals, unblocks and settings changes are hash-chained, so an edited or deleted entry is detected.

Screenshots use AutoDefender's built-in demo data, which is synthetic: documentation and private IP ranges, documentation AS numbers and fictional organizations. Click a screenshot to open it full size. Use the arrows, or select the gallery and press ← →.

How it works

  1. Read the logs: tail one or more Suricata eve.json files in real time, handling log rotation and partial lines, or batch-analyze historical logs.
  2. Detect and enrich: rate each event's severity, detect port scans and suspicious patterns, tag threats with MITRE ATT&CK techniques, and optionally add location data from offline MaxMind GeoLite2 databases.
  3. Explain: HIGH and CRITICAL threats go to a local Ollama model for a plain-English explanation, on a small worker pool with a per-minute call budget.
  4. Respond: playbooks bundle a drop rule, a log entry and a webhook notification into one approval. Rules are backed up before every change and can be unblocked or set to expire.
  5. Review: in the Streamlit web console (dashboard, incidents, threat analysis, actions, IP lists, playbooks, audit log) or the terminal UI.

Security decisions