QuietSOC：以證據為本的本地 AI 安全日誌調查助手構想

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 3: Slow and Steady

What I Built

QuietSOC is a concept for a local-first AI assistant designed to make security log investigation less tedious for junior Security Operations Center (SOC) analysts.

Security analysts regularly deal with large volumes of authentication events, failed login attempts, unusual access patterns, and other security signals. Reviewing these events manually takes time that could be spent investigating the incidents that matter most.

QuietSOC aims to simplify the first stage of that workflow.

The proposed application would let an analyst upload a Windows authentication log or normalized CSV file and receive an investigation brief containing:

• Suspicious activity: Rule-based identification of repeated failed logins and potentially suspicious authentication sequences.
• An understandable explanation: AI-generated summaries that explain what the events might mean in plain language.
• Traceable evidence: Relevant event IDs, timestamps, and supporting log entries.
• Recommended next steps: Practical suggestions for further investigation.
• A shareable report: A concise Markdown incident brief for documentation and handoffs.

The core idea is simple: analysts should not have to read every line of a log file before understanding where to start.

QuietSOC is currently a proposed project design, not a completed or tested application. The features above describe the intended functionality rather than verified capabilities.

Demo

A working demo is not available yet. The concept is to demonstrate a suspicious authentication sequence being uploaded, analyzed, and transformed into an evidence-backed incident briefing.

The planned demo would show the original events, the detection results, the AI explanation, and the final report in one workflow.

Code

The implementation has not yet been created, so there is no project repository to share at this stage.

The planned architecture uses Python, FastAPI, HTML, CSS, JavaScript, and local inference through Ollama.

How I Would Build It

The design separates security detection from AI-generated explanations.

1. Parse the logs

Python would normalize supported log formats into structured events containing timestamps, event identifiers, usernames, source addresses, and authentication outcomes where available.

2. Detect suspicious patterns

Deterministic Python rules would identify patterns such as repeated authentication failures and a successful login following a sequence of failures. These would be investigation signals, not automatic proof of an attack.

3. Explain the evidence with local AI

An open-weight model would receive a carefully selected set of relevant events and produce a structured explanation. Its output would need to reference the available evidence and acknowledge uncertainty rather than invent missing facts.

4. Present an investigation brief

A FastAPI backend and lightweight web interface would display the findings, event timeline, supporting evidence, severity assessment, and recommended next steps.

The proposed model is Gemma 3 running locally through Ollama. It has not yet been integrated or tested in this project.

Why Does Open Innovation Matter?

Security logs can contain sensitive operational information, usernames, internal addresses, and details about an organization's infrastructure. Sending such data to an external AI service may create privacy, compliance, or confidentiality concerns.

Open-weight models and local inference offer an alternative: organizations can explore AI-assisted workflows while retaining greater control over where their data is processed.

Open innovation also makes it possible for developers to inspect the surrounding implementation, adapt detection rules, evaluate model behavior, and build on publicly available tools rather than relying entirely on a proprietary service.

For a project like QuietSOC, transparency is particularly important. An AI-generated explanation should never replace the original evidence or become the sole basis for a security decision.

The long-term vision is an approachable, extensible assistant that helps junior analysts learn from their investigations while keeping the human analyst in control.

My Agent Session

No DevRelay agent session is available for this concept.

The Lazy Payoff

The intended benefit is to reduce the repetitive effort involved in manually reviewing authentication events, assembling a timeline, and writing an initial incident summary.

However, no time-saving measurements or user tests are available because the application has not been implemented.

A future evaluation would compare the time required to investigate the same synthetic log dataset manually versus with QuietSOC, while checking whether the generated findings remain accurate and traceable.

Prize Categories

No partner-category entry is being claimed at this stage. The proposed use of Gemma would need to be implemented and demonstrated before a Best Use of Gemma entry could be substantiated.

Final thought

QuietSOC began with a practical question: what if a junior SOC analyst could spend less time searching through repetitive logs and more time understanding the evidence?

The idea is to use open AI as an assistant to the investigation—not as a replacement for detection logic, evidence, or human judgment.

The next step is to turn this concept into a working, testable tool.