Identity-AI: Behavioral Threat Detection

Identity-AI is a lightweight, cross-platform security application that ingests and analyzes system authentication logs to detect suspicious behavior, privilege escalation attempts, and anomalous activity using statistical baselining.

Features

• 🛡️ Cross-Platform System Scanning: Automatically detects your host OS (Linux, Windows, macOS) and executes native commands (journalctl, Get-WinEvent, log show) to extract live real-world authentication events in real-time.
• 📂 Static Log Ingestion: Ingest traditional text-based .log files from other systems.
• 📊 Real-time Dashboard: A modern, interactive dark/light-themed dashboard built with HTML/CSS/JS and Flask.
• 📈 Advanced Baselines: Analyzes login frequencies, success/failure ratios, multiple IP usage, and time-of-day behaviors to compute a dynamic Risk Score for each user.
• 🗺️ Event Explorer: Search, filter, and paginate through thousands of logs instantly within the web interface.
• 📄 Export Reports: Export threat intelligence directly to CSV format.

Setup Instructions

Ensure you have Python 3.8+ installed.

# Clone the repository
git clone https://github.com/Naresh-R07/Identity-AI.git
cd Identity-AI

# Set up virtual environment
python -m venv venv
source venv/bin/activate  # On Windows use `venv\Scripts\activate`

# Install dependencies
pip install -r requirements.txt

# Start the application
python app.py

Then, open your browser and navigate to http://localhost:5000.

Usage

1. Dashboard Overview: View your organization's overall threat posture.
2. Scan System: Click the 💻 Scan System button to securely extract the last 7 days of local authentication logs from your machine.
3. Run Analysis: Click 🔍 Run Analysis to rebuild user baselines and detect compromised behavior. Adjust the Risk Threshold slider to filter out lower-risk warnings.
4. Detailed Views: Click on any high-risk user in the Top Threats table to view their comprehensive behavioral profile and recent malicious activity.

Operating System Support

OS	Live Scan Engine	Supported Events
Linux	journalctl	sshd, sudo, su, login, polkitd
Windows	PowerShell Get-WinEvent	Security EventIDs 4624 (Success), 4625 (Fail)
macOS	log show	Unified auth logs for sshd, sudo, su, login