CyberBrain IDS

CyberBrain is an intrusion detection system that watches live network traffic. A Random Forest and an XGBoost model vote on what they see, reading 22 or more packet features over a five second rolling window.

When something trips, a RAG pipeline takes over. An LLM with a Chroma index writes the incident up and maps it to MITRE ATT&CK, so the report names the technique rather than a port and a timestamp.

The SOC dashboard is React with a WebSocket stream, so detections arrive as they happen. Each incident carries six turns of follow up, which means an analyst can ask the model what it saw and keep asking until the answer is useful.