KAALI – AI Powered SOC Alert Correlation & Investigation Assistant. KAALI analyzes security logs, detects suspicious activity, correlates alerts, integrates threat intelligence, and uses AI to explain cyber attacks and recommend response actions. Built to simulate real SOC workflows using Python, FastAPI, Elasticsearch, and AI models.
The KAALI system is divided into modular components to handle the entire lifecycle of a security event.
Parses raw text logs (like Linux auth.log or Suricata IDS logs) in real-time, extracts key fields via regex, and forwards them as structured JSON documents into Elasticsearch.
Periodically queries structured logs to find anomalies or known-bad patterns (e.g., repeating failed logins from a single IP indicative of Brute Force attacks), creating Alerts in a local SQLite database.
Operates on the Alerts table to detect multi-stage attack scenarios. For instance, linking a sequence of failed logins followed by a successful login into a single Account Compromise Incident.
Automatically investigates the IPs and indicators found in Incidents by querying external reputation APIs like AbuseIPDB and VirusTotal, augmenting the Incident with threat context.
Once an Incident is enriched with Threat Intel, the entire context is sent to the Google Gemini API. Gemini acts as an autonomous Senior SOC Analyst, producing an executive summary, mapping to the MITRE ATT&CK framework, and providing actionable remediation steps.
A React (Tailwind CSS) frontend for human analysts to review statistics, investigate Incidents, read AI summaries, and monitor metrics via an intuitive user interface.
Takes defensive action against critical incidents, such as modifying iptables to block attacker IPs and sending email notifications to administrators.
- Install dependencies:
pip install -r requirements.txt- Copy the
.env.exampleto.envand fill in your API keys:
cp .env.example .env