Degree
Bachelor of Science (Computer Science)
Department
Department of Computer Science
School
School of Mathematics and Computer Science (SMCS)
Advisor
Dr. Faisal Iradat, Assistant Professor, School of Mathematics & Computer Science (SMCS)
Keywords
Wazuh, SIEM, XDR, Large Language Models, Retrieval-Augmented Generation, Agentic AI, Security Operations Center, Network Threat Classification, Model Context Protocol
Abstract
WazuhBot is an AI-powered security operations platform that enables cybersecurity analysts to investigate alerts and respond to threats using natural language. It integrates Retrieval-Augmented Generation (RAG), an agentic LLM chatbot, and a Random Forest machine learning model for network threat classification. The system retrieves live security data, provides contextual guidance, and requires explicit user confirmation before executing remediation actions. Its objective is to reduce investigation time, simplify SIEM operations, and improve security incident response.
Tools and Technologies Used
Python, JavaScript, Node.js, Express.js, Flask, React/Vite frontend, MySQL, Ollama, Large Language Models (LLMs), Retrieval-Augmented Generation (RAG), ChromaDB, Scikit-learn, Random Forest, Wazuh SIEM/XDR, OpenSearch, REST APIs, JWT Authentication, AES-256 Encryption, Model Context Protocol (MCP), HTML, CSS.
Methodology
The project followed a modular, iterative development approach. The system was designed as a multi-service architecture comprising a web frontend, Node.js backend, Python chatbot service, machine learning inference service, and MySQL database. RAG was implemented using ChromaDB to retrieve relevant Wazuh documentation, while an agentic LLM pipeline enabled natural-language queries and tool execution. A Random Forest classifier was trained on the NF-UQ-NIDS-v2 dataset to classify network threats. Remediation operations were protected by an explicit confirmation mechanism. The system was evaluated through functional testing, response-latency measurements, and safety testing on a live Wazuh deployment.
Document Type
Restricted Access
Submission Type
BSCS Final Year Project
Recommended Citation
Iqbal Aswani, T., Maqsood, M., & Siddiq, M. (2026). Wazuhbot: An AI-powered security operations platform. Retrieved from https://ir.iba.edu.pk/fyp-bscs/67
