Elastic GenAI SecOps

Open, AI-assisted security operations on the Basic-licensed Elastic Stack. Collect logs, detect threats with MITRE-mapped rules, correlate alerts into incidents and let an LLM suggest a triage decision — on masked data, with every case reviewed by an analyst.

Quick start Architecture Roadmap

How it works

Windows · FortiGate · Palo Alto · Kaspersky · syslog │ Logstash pipelines (integrations/sources) ▼ Elasticsearch ──► Kibana detection rules (30, MITRE ATT&CK) │ alerts ▼ detection-service ─► alert-gateway (correlation) ─► enrichment + masking ─► llm-orchestrator (masked, audited, one call per incident) ─► case-service ─► analyst review ─► notifications · tickets · MCP

What you get

SIEM out of the box

Elasticsearch, Kibana and Logstash with TLS, ILM, roles and 30 detection rules loaded automatically.

Privacy by design

Hosts, users and IPs are pseudonymized before the LLM; command lines never leave the platform.

Any LLM

Ollama for air-gapped sites, OpenAI-compatible APIs (OpenAI, DeepSeek, vLLM), Anthropic or Vertex AI.

Human in the loop

The LLM suggests; analysts decide. Tickets open only after approval. Nothing acts on its own.

Integrations

Slack, Teams, webhook, e-mail, TheHive, Jira, AbuseIPDB, MISP, and a read-only MCP server.

Auditable

Every LLM call is stored with the masked prompt, response, model and token usage.

Deploy anywhere

Docker Compose

deploy/compose — SIEM alone or with the AI platform layer.

Kubernetes

ECK + kustomize overlays for lab, on-prem and GKE.

Bare metal

One-command installer for Ubuntu 22.04.

Windows endpoints

Winlogbeat, Sysmon, Metricbeat and Heartbeat via Group Policy.

git clone https://github.com/yusufarbc/elastic-genai-secops.git
cd elastic-genai-secops/deploy/compose
./init-env.sh
docker compose -f siem.yml -f platform.yml up -d --build