🛡️ Agentic Cloud Security Operations Center (LLM-Sec)

An Autonomous, Multi-Cloud (AWS/Azure) Red Team Auditor powered by Generative AI and Machine Learning.

---

🚀 The 80 LPA FAANG Architecture

This project fundamentally re-architects how Enterprise Security Operations Centers (SOCs) function. It replaces human analysts with a decoupled, asynchronous Multi-Agent Orchestration Pipeline capable of sub-second threat neutralization across multi-cloud environments.

The Problem with Modern SOCs

Sending millions of raw AWS CloudTrail or Azure Sentinel logs directly to an LLM (like GPT-4) is an economic and architectural anti-pattern. It instantly hits API rate limits and incurs massive token costs.

The Multi-Agent Solution

This architecture implements Cost-Effective Triage by splitting the workload across specialized AI Agents:

1. 🤖 Agent 1: ML Data Engineer (scikit-learn)

   • Uses an IsolationForest Machine Learning algorithm running locally on CPU.
   • Standardizes AWS and Azure JSON payloads into a unified mathematical schema.
   • Instantly filters out 99.9% of normal network traffic for free, dropping non-threats before they ever reach the LLM.

2. 🧠 Agent 2: Generative AI Analyst (LangChain / OpenAI)

   • Triggered only when Agent 1 guarantees an anomaly.
   • Utilizes LLM Chain-of-Thought (CoT) reasoning to parse the raw JSON log.
   • Classifies the exact attack vector (e.g., AWS IAM Privilege Escalation vs Azure Blob Storage Exfiltration).

3. ⚡ Agent 3: Multi-Cloud DevOps Auto-Remediator

   • Implements Constrained Code Generation.
   • Dynamically writes the exact Infrastructure-as-Code (IaC) patch required to neutralize the threat.
   • Automatically generates AWS Boto3 Lambda functions or Azure Management SDK scripts to revoke IAM policies or update Network Security Groups (NSGs).

---

🏗️ Architecture Flow

graph TD
    %% Define Styles
    classDef cloud fill:#0f172a,stroke:#3b82f6,stroke-width:2px,color:#fff
    classDef agent fill:#1e1b4b,stroke:#8b5cf6,stroke-width:2px,color:#fff
    classDef react fill:#064e3b,stroke:#10b981,stroke-width:2px,color:#fff

    A[AWS EventBridge] -->|JSON Payload| C
    B[Azure Sentinel] -->|JSON Payload| C
    
    C(FastAPI Gateway & Unified Schema) -->|Streams Live Telemetry| UI

    C -->|Numerical Metrics| D
    
    subgraph Multi-Agent AI Orchestration
        D{"Agent 1: ML Isolation Forest"}
        D -->|Normal Traffic 99%| E[Dropped / Safe]
        D -->|Anomaly Detected!| F{"Agent 2: Generative AI (LLM)"}
        
        F -->|Chain-of-Thought Analysis| G{"Agent 3: DevOps Code Generator"}
    end

    G -->|AWS Threat| H[Generates Boto3 Lambda Patch]
    G -->|Azure Threat| I[Generates Azure SDK NSG Patch]

    H -.->|Triggers| UI
    I -.->|Triggers| UI

    UI((React WebSocket Dashboard))
    
    class A,B cloud;
    class D,F,G agent;
    class UI react;

Loading

---

🖥️ The Cyber Command Center UI

The entire pipeline operates asynchronously via FastAPI and pushes live telemetry to a React dashboard via WebSockets. This creates a "Live Telemetry" UI where security teams can watch the Agents communicate, analyze, and deploy fixes in real-time.

---

📁 Repository Structure

• main.py: The Asynchronous Multi-Agent API Gateway.
• simulate_logs.py: The Multi-Cloud Threat Injector (Generates exact AWS EventBridge and Azure Sentinel payloads).
• train_model.py: The scikit-learn Isolation Forest training script.
• /dashboard: The React + Vite WebSockets telemetry dashboard.
• /terraform: AWS ECS Fargate deployment scripts.

Note to Recruiters: Please review the CODE_EXPLANATION.md for a comprehensive line-by-line architectural breakdown.