Mehdicher/SOAR-with-AI-for-investigation-and-automated-response-to-the-top-3-most-frequent-SOC-incidents

AI-augmented SOAR platform for automated detection, investigation, and response to phishing, web exploitation, and Active Directory attacks — built on TheHive, Cortex, MISP, and Wazuh, with LLM-driven analyst assistance. Engineered as a PFE project with DXC Technology Morocco. A full-stack Security Orchestration, Automation and Response platform built to demonstrate end-to-end SOC workflows: detection, AI-assisted triage, threat intelligence enrichment, and automated response — across phishing email, web application attacks, and Active Directory threats. A full walkthrough of the platform in action is available here: Demo video This project was built as a PFE (end-of-study project) in collaboration with **DXC Technology Morocco**, simulating a real-world SOC environment and integrating several industry-standard security tools into a single orchestration layer. > **Note:** This repository contains documentation and architecture only. The source code is not publicly available because this is an internal project intended for implementation. It contains proprietary business logic, environment-specific configurations, and infrastructure details that are not suitable for public release. --- ## Architecture overview --- ## Architecture overview The diagram above shows the full lifecycle: three ingestion sources feed a shared correlation engine, which triggers AI threat analysis once enough events from the same source are seen. The result flows through threat-intel and sandbox enrichment into a case-management alert, and from there into a gated analyst workflow — assign, set verdict, contain, close — where containment actions are only unlocked after a true-positive verdict. The backend is a Django application using an ASGI server for real-time delivery; every detection, correlation result, and analyst action is pushed to the browser over a persistent WebSocket connection so the dashboard updates live with no polling for time-critical events. --- ## Core components **Ingestion layer.** Each module has its own collector. The phishing collector polls a mail capture sink and parses MIME content. The web-attack collector watches an inbound log directory and parses structured attack records. The AD collector exposes an authenticated R …