Quick-start guide to get SIEM Copilot running and analyzing your first logs.
cd backend
pip install -r requirements.txt
python -m uvicorn app.main:app --reloadcd frontend
npm install
npm run devGROQ_API_KEY=your_groq_api_key
GOOGLE_API_KEY=your_google_api_keyNavigate to Upload Logs from the sidebar. Drag and drop your .log, .csv, .json, or .txt files. The system auto-detects the format and parses events.
The Security Dashboard displays real-time metrics: total events, suspicious activity count, risk score with factor breakdown, severity distribution, top source IPs, and login trends.
Use the Investigation Chat to ask natural language questions about your data. The AI has full context of your uploaded logs and detected threats.
The Attack Timeline groups events into distinct attack chains by threat actor IP. Each chain includes an AI-generated narrative and next-move prediction.
Export comprehensive security reports with executive summaries, technical breakdowns, and recommended remediation steps.
| Method | Endpoint | Description |
|---|---|---|
| POST | /api/upload | Upload and parse a log file |
| GET | /api/dashboard | Retrieve dashboard metrics and risk score |
| POST | /api/chat | Send a natural language query to the AI |
| GET | /api/timeline | Get attack chains and event timeline |
| GET | /api/report | Generate a comprehensive security report |
| DELETE | /api/clear | Clear all stored logs and reset the database |