Building an AI Linux Security Assistant: From SSH Logs to Automated Threat Detection

Short summary

An open-source AI Linux Security Assistant parses SSH authentication logs to detect threats like brute-force attacks and generates structured reports with risk levels and recommended actions. The current Python CLI release extracts source IPs and events from auth.log, with planned features including local LLM integration, MITRE ATT&CK mapping, and a security dashboard. The project targets administrators managing multiple Linux servers who need faster security event analysis.

• •Open-source Python CLI analyzes SSH auth.log for brute-force and suspicious IPs
• •Generates structured security reports with risk levels and remediation steps
• •Roadmap includes local LLM integration, MITRE ATT&CK mapping, and Docker security module

Generated with AI, which can make mistakes.