Project overview
The system processes simulated enterprise security logs through a structured feature-engineering pipeline and an unsupervised Isolation Forest model. Events identified as anomalous are assigned severity and enriched with a human-readable incident report generated through a language-model integration.
Core components
- Processing pipeline for temporal, network and behavioral features.
- Isolation Forest model for anomaly scoring.
- Simulated real-time log consumption.
- LLM-assisted incident summaries and recommended actions.
- Persistent incident records and Streamlit visualization.
Dataset and implementation
The project used approximately six million simulated log records. A stratified sample of one million records preserved the original distribution for model development under limited hardware constraints.
Current limitations
The evaluation uses simulated data and the project does not automatically execute high-impact actions. Recommended actions are presented to demonstrate how future controlled integrations could work.