PhantomNet-v4.0 - Autonomous AI cybersecurity platform — 28 microser

项目说明

PhantomNet v4.0

> Capable, composable, yours. A self-hosted, AI-nati operations platform for teams that need defensible detection, go response, and control o security data.

PhantomNet v4.0 is a composable SOC platform built for security teams that want a practical alternative to lock-in. It brings together canonical security-event ingestion, correlation and MITRE-aligned e, endpoint in, case workflows, controlled breach-and-attack simulation (BAS), threat context, graph analysis, and operator-facing dashboards.

The project is designed around a simple operational principle: automate context and e; govern high-impact response. Detection and correlation can be fast, but containment actions such as blocking, isolating, or terminating require approval and HMAC-signed audit e. If required approval or audit e is una, containment fails closed.

Platform at a Glance

| Area | Capability |
|---|---|
| Event pipeline | canonical event schema, normalization, durable detection records, and broker-ready ingestion boundaries. |
| Detection and triage | BAS scenarios, MITRE-aligned detection e, correlation workflows, and analyst-ready alert states. |
| Case operations | Case lifecycle and go playbook transitions for in and response. |
| Endpoint co | Asset in, endpoint telemetry ingestion, and Wazuh-compatible forwarder registration and streaming boundaries. |
| Response go | Human approval for high-impact actions, HMAC-signed containment audit records, , rollback, and fail-closed behavior. |
| Cloud containment | Go AWS Security Group containment adapter with LocalStack-oriented integration co. |
| Threat context | Attack-path analysis, regional telemetry replication boundaries, tenant isolation, and integrity checks. |
| Operator experience | A React/Vite SOC dashboard and a Next.js portal with dedicated user and administrator views. |
| Resilience | Isolated SQLite regression harnesses plus a Docker-host recovery topology for broker and PostgreSQL restart . |

Security Model

PhantomNet is deliberately conser where it matters. A simulation, alert, or enrichment result does not independently authorize an impactful response. High-impact containment requests are approved by a human workflow and must generate signed audit e before the adapter can execute.

| Control | Expected behavior |
|---|---|
| Human approval | block, isolate, and terminate actions require a recorded appro. |
| Audit integrity | Response lifecycle records are HMAC signed and as a chain. |
| Fail-closed containment | Missing or invalid appro e prevents containment execution. |
| Tenant boundaries | Correlation, response, and audit workflows use tenant-scoped contracts and isolation checks. |
| Test isolation | Automated Python tests use isolated SQLite state; external dependencies are mocked or explicitly gated. |
| Secret handling | Runtime credentials and signing keys are supplied through en , not embedded in source. |

> Safe use notice: BAS and response functionality must be run only against systems you own or are explicitly authorized to test. The benchmark harnesses are non-destructive and use simulated adapters; they are not authorization to conduct li activity.

Architecture

PhantomNet uses independently deployable components with clear integration boundaries. The production topology can use PostgreSQL for durable records, Redis for supporting state, Redpanda/Kafka for event transport, and Neo4j for graph-dri. Unit and regression tests intentionally substitute isolated SQLite state and simulated adapters to make correctness repeatable without contacting external infrastructure.

The detailed architecture and event contracts are documented in Architecture, Event Bus Schema, and Runtime Security Posture.

Repository Layout

Quick Start: the Codebase

The following workflow is the fastest way to the repository locally. It exercises the isolated test suite and compiles both web interfaces without starting a production-like deployment.

Prerequisites

| Dependency | de baseline | Used for |
|---|---|---|
| Python | Python 3.12 | Backend, agents, tests, and benchmark harnesses |
| Node.js | Node 22 | Dashboard and portal builds |
| npm | Current Node-compatible npm | Frontend dependency installation and quality checks |
| Docker Engine + Compose v2 | Required only for Compose and reco | Full service topology and restart |

The current isolated regression gate contains 337 passing tests and 6 explicitly skipped en tests. The skipped checks require Docker or LocalStack and are not silently treated as successful integration .

Build the Operator Interfaces

The frontend projects ship committed package-lock.json files. Use npm ci for a reproducible checkout; use npm install only when intentionally updating dependencies and commit the resulting lockfile change.

The dashboard's production bundle uses an explicit 600 kB budget. This keeps the intentionally separated React bundle while pre an expected bundle-size message from obscuring real build regressions.

Local De and Deployment

Use Docker Compose only with non-production en . Secrets, passwords, HMAC keys, and provider credentials must be passed through the en or an untracked local en file.

The exact configuration, en requirements, operational rollout sequence, and topology-specific considerations are maintained in Deployment Guide and Operations Guide. Treat a clean docker compose up as a local integration step, not a production readiness certification.

Workflows

PhantomNet separates quick, safe regression e from Docker-host integration e.

| Workflow | Command | Scope and safety boundary |
|---|---|---|
| Core regression suite | python3 -m pytest -q -p no:cacheprovider | Isolated tests using SQLite and mockable boundaries. |
| Canonical SOC benchmark | python3 scripts/benchmark_canonical_soc.py | Temporary SQLite database and simulated response adapter; no external calls or endpoint actions. |
| Resilience stress benchmark | python3 scripts/run_resilience_stress.py --events 500 | Synthetic BAS-marked telemetry; idempotency and detection/alert in without response execution. |
| Dashboard quality gate | cd dashboard_frontend && npm run lint && npm run build | Static analysis and production bundle . |
| Portal quality gate | cd phantomnet-website && npm run lint && npm run build | Static analysis, TypeScript , and static-route generation. |
| Self-hosted release preflight | ./scripts/preflight_self_hosted_release.sh deploy/self-hosted/.env | Operator-controlled Docker host only; protected configuration, disabled response adapters, and Compose rendering without printing secret . |
| Docker recovery | ./scripts/run_docker_reco.sh | Docker-capable host only; runs against an internal-only, ephemeral test topology. |
| Wazuh go dry-run | python3 scripts/run_wazuh_go.py | SQLite-only, local Wazuh/endpoint simulation; approval, signed receipt, rollback, and HMAC audit e without network or endpoint changes. |
| Containerized Wazuh dry-run | ./scripts/run_docker_wazuh_go.sh | Docker-capable host only; repeats the local simulation in an internal-only, disposable hardened container. |

The benchmark scripts run directly from the repository root and do not require callers to set PYTHONPATH.

Docker Recovery

The recovery harness broker and PostgreSQL stop/start behavior, checks that dependent probes fail closed during each outage, then records HMAC- audit e after recovery. It uses a timestamped Compose project, an internal-only network, non-production credentials, and disposable .

Before running it, generate fresh test-only for RECO, RECO, and RECO. Follow the full procedure in Docker Recovery . Never point this runner at production infrastructure or provide production secrets.

Documentation

| Document | Purpose |
|---|---|
| Architecture | Component boundaries and system design. |
| Deployment Guide | En preparation and deployment considerations. |
| Operations Guide | Monitoring, logs, recovery, and operator practices. |
| API Documentation | Service and API reference material. |
| Event Bus Schema | E and schema con. |
| Go Correlation Engineering | deterministic rules, immutable re, offline fixtures, MITRE co, and bounded analyst-alert suppression. |
| Phase 4 E Integration | Tenant-scoped asset, endpoint, Wazuh, identity, intelligence, and graph e with explicit read-only pro and canonical correlation projection. |
| Phase 5 Analyst Operations | E hunts, dashboard context, alert and case decision traces, explainable review priority, and human-re guidance. |
| Phase 6 Go Response Readiness | Signed-audit request gating, side-effect-free preflight, adapter expectations, rollback readiness, and Wazuh posture. |
| Phase 7 Self-Hosted Deployment and Obser | Internal Compose topology, loopback ingress, readiness, bounded metrics, recovery, backup, and upgrade requirements. |
| Credibility and External-Proof Baseline | E taxonomy, public-claim policy, hardening priorities, and controlled external-lab proof gates. |
| Controlled External-Lab | Safe, non-production topology, recovery, BAS, Wazuh, AWS, agent, and benchmark proof protocols. |
| Go Response and Replication | Response go and telemetry replication contracts. |
| Tenant Isolation and Audit Integrity | Isolation checks and tamper-e audit . |
| AWS Security Group Containment | Cloud firewall adapter safety and boundary. |
| Docker Topology | Li PostgreSQL, Redis, Redpanda, and Neo4j round-trip proof. |
| Docker Recovery | Isolated broker/database restart test runbook. |
| Production-Readiness | Executed e, corrected findings, and remaining li boundaries. |
| SOC and SIEM Comparison | E positioning against Splunk, Wazuh, Sentinel, Elastic, and Security Onion. |
| Wazuh Integration and Migration Guide | Phased telemetry-first pairing plan, go boundaries, gates, and rollback procedure. |
| Wazuh Telemetry Pilot Deployment | Phase 1 sidecar and manager-integrated manifests, secret handling, , and rollback. |
| Wazuh Go Response Bridge Design | Phase 2 approval, command-binding, , audit, and rollback model. |
| Wazuh Go Response Deployment | Disabled-by-default bridge acti, agent staging, lab acceptance gates, failure injection, and emergency stop procedure. |
| Wazuh Go Operational Dry-Run | Safe isolated and Docker-host proof of approval, signed execution receipts, go release, and HMAC audit-chain . |
| Core-First Platform Roadmap | Current engineering sequence and remaining platform work. |

Current Engineering Focus

The core detection-to-go path is implemented and continuously regression-tested. The next operational milestones focus on the Compose deployment on a Docker-capable host, expanding production-backed endpoint response through an EDR integration, maturing interaction-capture honeypots, and completing an operator security review before any production deployment.

| Priority | Next milestone | Intended outcome |
|---|---|---|
| 1 | Docker-host deployment and recovery | Demonstrate restart behavior with real ephemeral Redpanda and PostgreSQL containers. |
| 2 | EDR integration boundary | Replace stub-only host isolation paths with EDR or osquery/Wazuh capability. |
| 3 | Honeypot interaction capture | Add production-oriented SSH and HTTP interaction e collection. |
| 4 | Operator documentation and security review | Prepare a defensible deployment and incident-operations package. |

Contributing

Contributions should preser's security in. Do not add code that bypasses appro, omits audit records, hardcodes secrets, or silently converts an adapter failure into a successful containment result. Every change should include focused tests and must pass the Python, dashboard, and portal quality gates described above.

For security-sensiti, prioritize the following order:

1. Security correctness and auditability.
2. Automated tests and isolation.
3. Functional correctness and clear failure handling.
4. Performance and cleanup.

Project Positioning

PhantomNet does not claim to replace every function of a large commercial SIEM, EDR, or SOAR product. Its purpose is narrower and practical: provide a self-hosted, composable SOC foundation that teams can inspect, operate, extend, and retain control over.

项目信息

开发语言：Python

Star 数：4

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Autonomous AI cybersecurity platform — 28 microservices, real-time threat detection, SOAR automation, blockchain audit trail, cross-platform agent, React SOC dashboard. 展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。