AutoSec: Advanced Cybersecurity Operations Platform

📸 Screenshots

Dashboard — System Overview

Blocklist — Dynamic IP Rule Management

Logs — Telemetry Log Viewer

🌟 Key Features

Core Security Capabilities

Advanced Integrations

Enterprise Features

🚀 Quick Start

Prerequisites

Installation

Access Points

First Steps

Verification

# Test API health
curl http://localhost:8080/api/health
# Test GeoIP functionality
curl "http://localhost:8080/api/geoip?ip=8.8.8.8"
# Check all services are running
docker compose ps
# View service logs
docker compose logs -f autosec-backend
docker compose logs -f autosec-frontend
# Test database connections
docker compose exec autosec-backend npm run db:migrate -- --dry-run

🏗️ Architecture Overview

System Components

Frontend Layer

API Gateway & Services

AI/ML Engine (Implemented)

Data Layer

Enterprise Integrations (Implemented)

Enhanced Security Operations

Infrastructure & DevOps

Security Features

Network Security

Behavioral Analytics

Incident Response

📋 Current Implementation Status

✅ Implemented Features

Core Platform

Authentication & Authorization

Security Features

Behavioral Analysis Engine

Firewall Integrations

✅ Advanced Features (Recently Added)

Advanced Integrations

Threat Intelligence & Analytics

Incident Response & Automation

Attack Surface Management

🎯 Planned Features

Enterprise Features

Analytics & Reporting

Advanced Security Features

🔧 Development Setup

Local Development Environment

Testing

# Backend tests (unit, integration, and API tests)
cd backend
npm test # Run all tests
npm run test:watch # Run tests in watch mode
npm run test:coverage # Generate coverage report
# Frontend tests
cd frontend
npm test # Run React tests
npm run test:coverage # Generate coverage report
# End-to-end testing
npm run test:e2e # Full application testing
# Load testing
npm run test:load # Performance and load testing

Code Quality & Security

# Backend linting and formatting
cd backend
npm run lint # ESLint check
npm run lint:fix # Auto-fix linting issues
npm run format # Prettier formatting
# Security auditing
npm audit # Check for security vulnerabilities
npm run security:check # Additional security scanning
# Frontend linting
cd frontend
npm run lint
npm run lint:fix
# Dependency checking
npm run deps:check # Check for outdated dependencies
npm run deps:update # Update dependencies

Database Management

# PostgreSQL migrations and seeding
cd backend
npm run db:migrate # Run database migrations
npm run db:seed # Seed database with initial data
npm run db:reset # Reset database (dev only)
# MongoDB setup
npm run mongo:setup # Initialize MongoDB collections
npm run mongo:index # Create database indexes

🚀 Production Deployment

Kubernetes Deployment

# Deploy with Helm (coming soon)
# helm repo add autosec https://gizzmo.github.io/AutoSec-helm-charts
# helm install autosec autosec/autosec-platform
# Or use kubectl
kubectl apply -f k8s/namespace.yaml
kubectl apply -f k8s/postgres.yaml
kubectl apply -f k8s/mongodb.yaml
kubectl apply -f k8s/rabbitmq.yaml
kubectl apply -f k8s/backend.yaml
kubectl apply -f k8s/frontend.yaml
kubectl apply -f k8s/ingress.yaml

High Availability Configuration

# Example production values.yaml for Helm
replicaCount:
 backend: 3
 frontend: 2
 
autoscaling:
 enabled: true
 minReplicas: 2
 maxReplicas: 10
 
resources:
 backend:
 requests:
 memory: "512Mi"
 cpu: "500m"
 limits:
 memory: "1Gi"
 cpu: "1000m"
persistence:
 postgresql:
 size: 100Gi
 storageClass: "fast-ssd"
 mongodb:
 size: 500Gi
 storageClass: "fast-ssd"

Security Hardening

# SSL/TLS Configuration
kubectl create secret tls autosec-tls \
 --cert=path/to/cert.pem \
 --key=path/to/key.pem
# Database encryption
kubectl create secret generic db-encryption-key \
 --from-literal=key=$(openssl rand -base64 32)
# Service mesh (Istio)
kubectl label namespace autosec istio-injection=enabled

Monitoring & Observability

# Prometheus & Grafana
helm install prometheus prometheus-community/kube-prometheus-stack
# ELK Stack
helm install elasticsearch elastic/elasticsearch
helm install kibana elastic/kibana
# Jaeger for distributed tracing
kubectl apply -f https://github.com/jaegertracing/jaeger-operator/releases/download/v1.29.0/jaeger-operator.yaml

📊 API Documentation

Authentication Endpoints

# User authentication
POST /api/auth/register # Register new user
POST /api/auth/login # User login
POST /api/auth/logout # User logout
POST /api/auth/refresh # Refresh access token
GET /api/auth/profile # Get user profile
PUT /api/auth/profile # Update user profile
POST /api/auth/change-password # Change user password
# Multi-Factor Authentication
POST /api/mfa/setup # Setup MFA for user
POST /api/mfa/verify # Verify MFA token
POST /api/mfa/disable # Disable MFA
GET /api/mfa/qr # Get QR code for MFA setup
# User management (Admin only)
GET /api/users # List all users
POST /api/users # Create new user
GET /api/users/:id # Get user by ID
PUT /api/users/:id # Update user
DELETE /api/users/:id # Delete user
POST /api/users/:id/roles # Assign roles to user

Security Management

# Blocklist management
GET /api/rules # Get all blocking rules with pagination
POST /api/rules # Create new blocking rule
PUT /api/rules/:id # Update existing rule
DELETE /api/rules/:id # Delete blocking rule
# Threat intelligence and analysis
GET /api/threats # Get threat indicators
POST /api/threats/scan # Initiate threat scan
GET /api/threats/feeds # Manage threat feeds
POST /api/threats/ioc # Add indicators of compromise
# Behavioral analysis
GET /api/behavior/user/:id # Get user behavior analysis
GET /api/behavior/network # Get network behavior metrics
POST /api/behavior/analyze # Trigger behavior analysis
GET /api/behavior/anomalies # Get detected anomalies
GET /api/behavior/risk-score # Get current risk scores
# Threat hunting
POST /api/threat-hunting/start # Start new threat hunting campaign
GET /api/threat-hunting # Get all threat hunts
GET /api/threat-hunting/active # Get active threat hunts
GET /api/threat-hunting/stats # Get threat hunting statistics
GET /api/threat-hunting/templates # Get available hunt templates
GET /api/threat-hunting/:huntId # Get specific threat hunt
POST /api/threat-hunting/:huntId/stop # Stop a running hunt
DELETE /api/threat-hunting/:huntId # Delete a threat hunt

Log Management & Analytics

# Log ingestion and retrieval
POST /api/logs # Ingest log data (accepts batch)
GET /api/logs # Retrieve logs with advanced filtering
GET /api/logs/search # Full-text search in logs
GET /api/logs/stats # Get log statistics and metrics
GET /api/logs/export # Export logs (CSV, JSON)
# Real-time analytics
GET /api/analytics/dashboard # Main dashboard data
GET /api/analytics/threats/live # Live threat feed
GET /api/analytics/network/traffic # Network traffic analysis
GET /api/analytics/users/behavior # User behavior patterns
GET /api/analytics/geo # Geographic threat distribution

System Utilities

# GeoIP and location services
GET /api/geoip?ip=<IP> # Get GeoIP information for IP
GET /api/geoip/bulk # Bulk GeoIP lookup
# System health and monitoring
GET /api/health # System health check
GET /api/status # Detailed system status
GET /api/metrics # System performance metrics
GET /api/version # API version information

🔗 Integration Examples

Firewall Integration

// Palo Alto Networks Integration
const PaloAltoIntegration = require('./integrations/paloAltoIntegration');
const paloAlto = new PaloAltoIntegration({
 hostname: 'firewall.company.com',
 username: process.env.PALO_ALTO_USERNAME,
 password: process.env.PALO_ALTO_PASSWORD,
 // or use API key authentication
 apiKey: process.env.PALO_ALTO_API_KEY,
 vsys: 'vsys1'
});
// Block IP address with context
await paloAlto.blockIP('192.168.1.100', {
 reason: 'Suspicious activity detected',
 severity: 'high',
 source: 'AutoSec Behavioral Analysis'
});
// Create address group for batch blocking
await paloAlto.createAddressGroup('autosec-threats', [
 '10.0.0.100',
 '10.0.0.101',
 '10.0.0.102'
]);
// Cisco ASA Integration
const CiscoASAIntegration = require('./integrations/ciscoASAIntegration');
const ciscoASA = new CiscoASAIntegration({
 hostname: 'asa.company.com',
 username: process.env.CISCO_USERNAME,
 password: process.env.CISCO_PASSWORD,
 enablePassword: process.env.CISCO_ENABLE_PASSWORD
});
// Add access control rule
await ciscoASA.addAccessRule({
 name: 'BLOCK_THREAT_192.168.1.100',
 source: '192.168.1.100',
 destination: 'any',
 action: 'deny',
 protocol: 'ip'
});
// iptables Integration for Linux systems
const IptablesIntegration = require('./integrations/iptablesIntegration');
const iptables = new IptablesIntegration({
 sudo: true,
 chain: 'INPUT'
});
await iptables.blockIP('192.168.1.100', {
 protocol: 'tcp',
 port: 22,
 comment: 'AutoSec: SSH brute force attempt'
});

Multi-Factor Authentication

const MFAService = require('./services/mfaService');
const mfaService = new MFAService();
// Setup MFA for user
const mfaSetup = mfaService.generateSecret(username, 'AutoSec');
const qrCode = await mfaService.generateQRCode(mfaSetup.dataURL);
// Verify MFA token
const isValid = mfaService.verifyToken(token, user.mfaSecret);
// Generate backup codes
const backupCodes = mfaService.generateBackupCodes();

Behavioral Analysis Integration

const MLBehaviorAnalysisService = require('./services/mlBehaviorAnalysisService');
const mlService = new MLBehaviorAnalysisService();
// Analyze user behavior patterns
const behaviorAnalysis = await mlService.analyzeUserBehavior({
 userId: 'user123',
 loginTimes: [...],
 ipAddresses: [...],
 deviceFingerprints: [...],
 accessPatterns: [...]
}, 'user123');
// Get risk score
const riskScore = behaviorAnalysis.riskScore;
if (riskScore > 0.8) {
 // Trigger additional security measures
 await triggerMFAChallenge(userId);
}
// Analyze network behavior
const networkAnalysis = await mlService.analyzeNetworkBehavior({
 trafficPatterns: [...],
 connectionMetrics: [...],
 protocolDistribution: [...]
});

Threat Hunting Integration

const { threatHuntingService } = require('./services/threatHuntingService');
// Start a threat hunt using a pre-built template
const hunt = await threatHuntingService.startThreatHunt({
 name: 'APT Detection Hunt',
 description: 'Hunting for Advanced Persistent Threat indicators',
 template: 'apt-detection', // Use pre-built template
 timeRange: '7d', // Search last 7 days
 priority: 'high',
 userId: 'admin-user-id'
});
// Start a custom threat hunt
const customHunt = await threatHuntingService.startThreatHunt({
 name: 'Custom Data Exfiltration Hunt',
 description: 'Looking for unusual data transfers',
 hypothesis: 'Insider threat performing data exfiltration via cloud storage',
 queries: [
 {
 name: 'Large uploads to external domains',
 type: 'network',
 pattern: 'bytes_out > 100MB AND destination NOT internal',
 timeWindow: '24h'
 },
 {
 name: 'After-hours file access',
 type: 'behavior',
 pattern: 'login_time NOT IN working_hours AND file_access_count > 50',
 timeWindow: '12h'
 }
 ],
 timeRange: '24h',
 priority: 'critical',
 userId: 'admin-user-id'
});
// Get hunt status and findings
const huntResults = await threatHuntingService.getThreatHunt(hunt._id);
console.log(`Hunt status: ${huntResults.status}`);
console.log(`Findings: ${huntResults.summary?.totalFindings || 0}`);
// Get threat hunting statistics
const stats = await threatHuntingService.getThreatHuntingStats();
console.log(`Total hunts: ${stats.totalHunts}`);
console.log(`Active hunts: ${stats.activeHunts}`);
console.log(`Available templates: ${stats.availableTemplates.join(', ')}`);

🤝 Contributing

Development Guidelines

Reporting Issues

📄 License

🆘 Support

🙏 Acknowledgments