CapStoners

Security incident triage helper built during a weekend hackathon. We cluster noisy SOC logs, surface high-signal clusters, and generate concise AI-guided playbooks to accelerate analyst response.

What it does

• Ingests security events, clusters related activity, and surfaces severity/confidence with stats.
• Generates AI analyses (structured, rapid, IOC, timeline, risk, detection) via local Ollama LLM.
• Caches AI outputs per cluster/method with a one-click “Regenerate” option.
• Exports clusters to CSV for sharing and downstream work.

Architecture

• Frontend: React (soc-triage-web) with rich markdown rendering and analysis viewer.
• Backend: Node/Express + MongoDB for events, clusters, and cached AI analyses.
• LLM: Local Ollama endpoint (default model mistral, override with OLLAMA_MODEL).

Quickstart

1. Building the Frontend

cd soc-triage-web
npm install
npm run build
# generates a static html and js file for optimized production builds

2. Backend

cd backend
npm install
cp .env.example .env   # create if missing
# set MONGO_URI, OLLAMA_URL (e.g., http://localhost:11434), OLLAMA_MODEL, PORT
node app.js
# this starts the app on localhost port 5000

Key flows

• Regenerate clusters: POST /api/clusters/regenerate or use UI button.
• Analyze a cluster: UI “🤖 Analyze with AI” → GET /api/clusters/:id/analyze?method=standard|rapid|ioc|timeline|risk|detection.
• Force refresh analysis: add regenerate=true to the analyze endpoint or click “🔄 Regenerate” in the panel.

Notes

• Ollama must be running locally to generate analyses; cached responses still serve if available.
• Caching lives in MongoDB (ai_analyses + analysis_timestamps per cluster).
• Build for prod: npm run build in soc-triage-web and serve the build/ folder via Express static hosting (already wired in backend/app.js).

License

MIT