Case Study
Mini-SIEM AI
AI-powered Security Information and Event Management system with ML attack classification, automated risk scoring, and SHAP explainability.
What is Mini-SIEM AI?
Mini-SIEM AI is a lightweight, intelligent Security Information and Event Management (SIEM) tool designed to monitor logs, classify cyber attacks using Machine Learning, and automatically generate narrative incident reports using LLMs.
Problem
Traditional SOC analysts spend roughly 45 minutes manually triaging a single complex alert. Legacy SIEMs rely on static regex rules that generate high false-positive rates and offer "black-box" alerts with little explanation.
Architecture & Solution
Ingestion: Real-time network logs
ML Classifier: Ensemble attack classification
Risk Scoring: Automated severity assessment
Explainability: SHAP feature contribution
Reporting: Groq LLM sub-second narratives
Tech Stack
PythonStreamlitScikit-learnSHAPPandasGroq API
SOC Triage Benchmark • Comparative Analysis
| Dimension | Traditional Rule-Based SIEM | Mini-SIEM AI Architecture |
|---|---|---|
| Detection Engine | Static regex & threshold alerts (high fatigue) | Multi-class Scikit-learn ML classifier |
| Alert Transparency | Cryptic raw log dumps (black-box) | Mathematical SHAP feature attribution |
| Triage Turnaround | 30–45 minutes manual triage per incident | Sub-second Groq LLaMA narrative summaries |
| Threat Mapping | Manual analyst cross-referencing | Automated severity risk scoring & classification |