A fully functional, air-gapped AI Security System demonstrating agentic orchestration patterns in a controlled offline environment.
This AI Security System is a personal operating system running entirely air-gapped on local hardware. Four autonomous agents (Alpha, Beta, Gamma, Delta) coordinate across a complete infrastructure stack—executing real threat scenarios, validating response playbooks, and demonstrating how AI accelerates security workflows in a controlled, offline environment.
Each entry below is a real, running system — not theoretical. All systems are fully air-gapped from the public internet and built end-to-end from infrastructure through AI integration.
Four autonomous agents running locally on a Beelink mini-PC, fully air-gapped. Agents coordinate in real-time via FastAPI/WebSocket chat backend, reason over MITRE ATT&CK and MITRE ATLAS threat frameworks, and synthesize findings into shared context via a persistent vault system. Includes a 3D sphere visualization showing agent activity, local text-to-speech for spoken findings, and SQLite persistence across sessions.
Self-hosted infrastructure providing real threat scenarios for the agents to hunt: segmented network topology with jump box, processing layer, and isolated target VMs. Kali Linux as attacker platform. ELK stack (Elasticsearch/Kibana) ingests telemetry from three vulnerable web applications via Filebeat/Metricbeat. Atomic Red Team payloads executed and mapped to MITRE ATT&CK technique IDs. Containerized services via Docker for reproducible threat scenarios. This gives agents real logs to analyze, not synthetic sample data.
Five-phase delivery: Foundation, Agent Development, Integration, Hardening, and Testing & Deployment. Current status below.
Network topology, infrastructure provisioning (Beelink + Raspberry Pi cluster), ELK stack setup, systemd service scaffolding.
Built four autonomous agents (Alpha/Beta/Gamma/Delta), agent orchestration state machine, per-agent personas, vault memory system, MITRE ATT&CK and MITRE ATLAS reasoning.
FastAPI backend with WebSocket protocol, React chat UI with streaming, Three.js sphere visualization, ELK telemetry pipeline, investigation grading system, Vault RAG and Command Center UI.
Streaming responses, Kokoro TTS voice synthesis, concurrent agent reactions (alive room), inference performance optimization, comprehensive documentation, 12+ production patches, agent personality seeding.
Concurrent multi-agent room testing, agent persona refinement under load, performance benchmarking, production environment validation, live room deployment.
Five integrated applications powering orchestration, threat detection, response coordination, and knowledge persistence.