Case study
The hundred-eyed watchman: an AI-powered, event-driven security event analysis platform.
Chapters
5
attack scenarios on demand
3
Kafka topics in the pipeline
0
API keys needed to run
Live
WebSocket security console
What & why!
Argus ingests a live stream of security logs, detects threats with stateless and stateful rules, correlates alerts into incidents, and explains each incident in plain language.
Everything streams to a real-time security console with an Attack Simulator, a Log Explorer and a pipeline trace view that follows one event from raw log to AI summary. The whole stack runs with zero API keys thanks to a deterministic summary fallback.
From raw log to AI summary!
Scenario generator
Emits benign background traffic, plus attack scenarios via /simulate.
Kafka: raw.logs
Every event enters the pipeline here.
Parser
Validates and normalizes each event against a shared Zod contract.
Detection engine
Stateless and stateful rules turn normalized events into alerts.
Incident engine
Correlates alerts by entity and time window into incidents in Postgres.
AI engine
An LLM (Groq or Gemini) writes the summary, or a deterministic template does.
Realtime dashboard
WebSocket fan-out to the Next.js console, plus REST for traces and search.
The fun parts!
A single Zod package is the source of truth for every event shape, shared by the generator, the processing monolith and the dashboard, so a change breaks at compile time instead of in production.
Rules that need history (bursts, sequences) use a detection window store. It stays in-process by default and moves to Redis for multi-instance runs, along with the internal event bus.
Summaries come from an LLM when a key is configured and from a deterministic template otherwise, so the full pipeline, including the AI step, works on a fresh clone with no secrets.
Token-bucket rate limits on every endpoint (tighter on login) stop scripts from draining the LLM's free tier, and auth bootstraps like Grafana: open until the first account registers, locked after.
Built with!
Next case study
HobbyHive