wanthinnn/smartxdr-core repository overview

⁠Cyberfortress SmartXDR Core

AI-Powered Extended Detection and Response Platform

SmartXDR Core is an intelligent security operations platform that leverages Large Language Models (LLM) and Retrieval-Augmented Generation (RAG) to enhance threat detection, analysis, and response capabilities.

⁠Table of Contents

• Features⁠
• Architecture⁠
• Requirements⁠
• Quick Start⁠
• Configuration⁠
• API Reference⁠
• Management CLI⁠
• Security⁠
• License⁠

⁠Features

⁠AI/LLM Integration

• RAG-based question answering with knowledge base
• Semantic caching for improved response times
• Support for OpenAI models
• Customizable prompts for different use cases

⁠IOC Enrichment

• Integration with IRIS (Incident Response Information Sharing)
• IntelOwl report analysis with AI explanations
• Automated case IOC processing
• Risk assessment and recommendations

⁠Triage and Alert Management

• Elasticsearch integration for alert aggregation
• ML-based log classification (ERROR/WARN/INFO)
• Automated alert summarization
• Daily report scheduling with email notifications

⁠Telegram Bot

• Real-time security notifications
• Interactive threat queries
• Webhook and polling mode support
• Cloudflare Tunnel auto-configuration

⁠Security

• API Key authentication with Argon2id hashing
• Role-based access control (RBAC)
• Rate limiting per API key
• IP whitelisting support
• Permission-based endpoint protection

⁠License

This project is licensed under the GNU Affero General Public License v3.0 (AGPL-3.0).

See LICENSE⁠ for details.