Multi-Agent Autonomous Threat Intelligence System

Author: GANTA BALA AMOGH RAJ <balaamoghraj@gmail.com>
GitHub: Amogh0786

A production-ready Multi-Agent Autonomous Threat Intelligence System leveraging high-speed LLM triage, cyclical LangGraph state-machine orchestration, real-time WebSocket streaming, semantic MITRE ATT&CK vector retrieval, and a dark-mode cyber SOC terminal interface with Human-in-the-Loop (HITL) least-privilege defense approval.

---

🏗️ System Architecture & Tech Stack

graph TD
    A[Raw Telemetry / Attack Log] -->|WebSocket / REST| B(Node 1: The Detector<br>Gemini 1.5 Flash + Prompt Defense)
    B -->|is_suspicious == true & confidence > 0.80| C(Node 2: The Researcher<br>Gemini 1.5 Pro + Vector DB & Live Feeds)
    B -->|is_suspicious == false| G[END / Benign Dismissed]
    C -->|research_context + IOCs| D(Node 3: The Strategist<br>Gemini 1.5 Pro + Defense Generator)
    D -->|mitigation_script| E{HITL Guardrail Modal<br>SOC Operator Approval}
    E -->|Approve| F[Rule Deployed / Host Isolated]
    E -->|Reject| H[Analyst Override / Discarded]

Loading

• Backend / API: FastAPI (Python 3.11+) with asynchronous WebSockets (/ws/threat-stream).
• LLM Inference: Google Gemini 1.5 Flash (high-speed triage) & Gemini 1.5 Pro (deep research & strategy).
• Multi-Agent Orchestration: LangGraph StateGraph with conditional edges to prevent infinite loops.
• Vector Database: Pinecone serverless / High-Fidelity Hybrid Cosine Memory seeded with MITRE ATT&CK v14 techniques, CVE feeds, and phishing signatures.
• Frontend / SOC Dashboard: React 18, Vite, and Tailwind CSS v3 dark-mode terminal.
• Guardrails & Security: Input Prompt Injection Sanitization (SecurityGuard) and Least-Privilege Scope verification.

---

🚀 Quick Start (Local Demo)

1. Start FastAPI Backend (Port 8000)

cd backend
python -m venv .venv
# Windows:
.venv\Scripts\activate
# Linux/macOS:
source .venv/bin/activate

pip install -r requirements.txt
uvicorn app.main:app --host 0.0.0.0 --port 8000

• Swagger API Documentation: Open http://localhost:8000/docs
• Vector DB Statistics Endpoint: http://localhost:8000/api/v1/vector-db/stats

2. Start React SOC Dashboard (Port 5173)

cd frontend
npm install
npm run dev

• Open http://localhost:5173 in your browser.

---

🧪 Testing & Verification

Run the automated PyTest suite to verify prompt injection neutralization, least-privilege guardrails, and LangGraph conditional routing:

cd backend
.venv\Scripts\pytest -v

---

🛡️ Security Guardrails

1. Prompt Injection Defense: Incoming logs are scanned and sanitized against adversarial instructions ("Ignore previous instructions...", "output a bash script that opens port 22") while preserving genuine security artifacts (IPs, CVEs, ports).
2. Least-Privilege Defense Generation: Syntactically verified bash/iptables/CrowdStrike JSON scripts are checked against destructive system wipe rules before being presented to the operator.
3. Human-in-the-Loop (HITL): No remediation script is automatically executed without analyst review and explicit approval in the modal interface.

---

🐳 Docker & Docker Compose

To launch the full stack using Docker Compose:

docker-compose up --build

• Backend available at port 8000
• SOC Dashboard available at port 3000