CoolFace
Apppublic

sreejanjalagam/kill-chain-forensics-agent

sourceHugging Faceupdated 5mo agoView on Hugging Face
0likes
App README

🕵️ Kill Chain Forensics Agent (A-11)

Live inference Space for time-travel forensics with honeypot log replay, MITRE ATT&CK mapping, IOC generation, and geo-coordinate correlation.

Features

  • —🔪 Kill Chain Reconstruction — Replay logs chronologically
  • —📍 MITRE ATT&CK Mapping — Every step mapped to technique ID
  • —🌍 Geo-Plotting — Attacker location on world map (Plotly)
  • —🎯 IOC Report — IPs, domains, file hashes, user agents
  • —⏱️ Timeline Visualization — Horizontal kill chain timeline
  • —🔗 CI/CD Correlation — Pipeline events mapped to attack steps

Demo

Beat 10 (2:45): Honeytoken fires at 40.7°N, 74.0°W. World map shows red pulse. Kill chain reconstructed in real-time.

Core Actions

ActionDescription
reconstruct_kill_chainReplay all honeypot logs chronologically
map_mitre_techniquesMap every step to MITRE ATT&CK technique ID
generate_ioc_reportExtract IPs, domains, file hashes
correlate_honeytokenGeo-plot attacker origin on world map
submit_to_trainingFeed reconstructions back for continuous improvement

Model

  • —Base: Qwen/Qwen2.5-3B-Instruct
  • —Fine-tuned: sreejanjalagam/kill-chain-forensics-v1
  • —Dataset: sreejanjalagam/kill-chain-forensics-training-data (51K+ examples)