This repository contains a Go-based SIEM agent that employs LLM-based AI for real-time classification and investigation of security log events. It includes a responsive React dashboard for semantic search, analytics, and MITRE ATT&CK mapping. The agent parses logs into structured fields, classifies them, maps to MITRE tactics, and extracts indicators of compromise.
From the README
Go SIEM Agent — LLM Classifier A production-ready Security Information and Event Management (SIEM) agent built in Go that uses LLM-based AI to classify, triage, and investigate security log events in real time. Features a fully responsive React dashboard with semantic search, analytics, and MITRE ATT&CK mapping. --- What It Does Paste or upload any log line (syslog, nginx, auth.log, Windows Event, etc.) and the agent: 1. Parses the raw log into structured fields (host, app, timestamp, message) 2. Classifies it via LLM — determines attack type, severity (P1–P5), confidence score 3. Maps to MITRE ATT&CK tactic + technique (e.g. T1110 Brute Force) 4. Extracts IOCs — IPs, domains, file...
Skills
- Go
- TypeScript
- HTML
- Makefile
- CSS
