ZEROTRACE is a modular, evidence-grounded AI security investigation platform built for SOC analysts. It actively ingests security telemetry, correlates events into structured incidents, extracts IOCs, maps attacker behavior to the MITRE ATT&CK framework, and uses LLMs to synthesize factual, evidence-backed investigation reports and response actions.

• Live Telemetry Ingestion: Normalizes raw logs (Sysmon, EDR, Network, DNS, Auth) into a unified SecurityEvent schema.
• Automated Incident Correlation: Groups related security events based on time windows and shared IOCs (hosts, users).
• MITRE ATT&CK Mapping: Automatically identifies attacker tactics and techniques from event types.
• Evidence-Grounded AI Synthesis: Generates human-readable incident summaries and remediation steps backed strictly by observed telemetry,
• without hallucinating details.

SOC Analyst Console: An ultra-minimal, typography-driven React/Vite frontend tailored for high-speed triage.

🏗 Architecture Overview

ZEROTRACE/
├── .env                  # Environment configuration (API keys, DB URLs)
├── backend/
│   ├── app/
│   │   ├── main.py       # FastAPI application entrypoint with CORS & API routing
│   │   ├── core/         # Pydantic BaseSettings config & Database sessions
│   │   ├── db/           # SQLite repository abstraction layer
│   │   ├── models/       # Pydantic v2 schemas & SQLAlchemy ORM models
│   │   ├── api/v1/       # REST API Endpoints (Incidents, Events, IOCs, Health)
│   │   └── modules/      # Core Business Logic
│   │       ├── ingestion/     # Log ingest and routing
│   │       ├── normalization/ # Parsing and standardizing logs (DNS, Sysmon, etc.)
│   │       ├── extraction/    # IOC extraction
│   │       ├── correlation/   # Event clustering logic
│   │       ├── mitre/         # Threat intelligence mapping
│   │       └── investigation/ # AI and synthesis engines
│   └── tests/            # Pytest test suite
└── frontend/             # React (Vite) SOC Console
    ├── src/
    │   ├── components/   # UI Modules (Overview, Timeline, AI Investigation, etc.)
    │   ├── services/     # API Axios client
    │   └── index.css     # Minimalist Dark Theme
    └── vite.config.js