a cybersecurity telemetry platform that watches what's happening on a system, figures out what's suspicious, and tells you about it.
aegoria takes raw system logs, processes them through a rust-based detection engine, passes the results through machine learning models for deeper analysis, stores everything in a database, and presents it through a monitoring dashboard. the whole pipeline ends with a structured security report — both in the browser and as a PDF.
it's not a commercial product. it's a working system built to demonstrate what a complete security telemetry pipeline looks like when you connect the pieces properly.
the system is split into three repositories, each handling a different layer:
system logs
│
▼
aegoria-rust (port 3000)
telemetry engine — collects, parses, analyzes, scores
outputs: SecurityReport JSON
│
▼
ai-model (port 5001)
AI analysis — ML scoring, MITRE rules, threat classification
outputs: enriched threat analysis
│
▼
aegoria-monitoring-dashboard (port 3001)
storage + visualization — PostgreSQL, REST API, React dashboard
outputs: web interface + PDF report
a pipeline orchestrator in the ai-model repo ties everything together. one command runs the full pipeline and produces a complete security report.
the core detection engine. reads system logs, parses them into structured telemetry events, runs behavioral analysis (login bursts, privilege escalation, suspicious processes, network anomalies), enriches events with threat intelligence, correlates attack patterns, computes risk scores, and generates a detailed security report.
built in Rust with Axum. processes 10k events in about 3ms.
the AI analysis layer. takes the rust engine's security report and runs it through a two-layer ML scoring system (isolation forest + online SVM), 18 MITRE ATT&CK detection rules, and an alert correlation engine. also includes a secondary model that audits the primary model weekly for adversarial poisoning.
contains the pipeline orchestrator that coordinates all three services, and a PDF report generator.
the frontend and persistence layer. an Express backend stores combined reports in PostgreSQL. a React dashboard displays risk scores, AI threat classifications, attack timelines, event distributions, and security recommendations.
the full pipeline looks like this:
1. rust engine scans system logs
2. produces a SecurityReport (threats, timeline, risk score, recommendations)
3. ai-model receives the report via HTTP
4. runs ML scoring + rule evaluation on each event
5. returns enriched analysis (threat score, classification, MITRE technique)
6. orchestrator merges rust + AI results
7. sends combined report to dashboard backend
8. dashboard stores it in PostgreSQL
9. frontend displays it to the analyst
10. PDF report is generated locally
# terminal 1 — rust engine
cd aegoria-rust && cargo run
# terminal 2 — AI service
cd ai-model && python3 -m uvicorn drift_detector.api_server:app --port 5001
# terminal 3 — dashboard backend
cd aegoria-monitoring-dashboard/backend && npm run dev
# terminal 4 — dashboard frontend
cd aegoria-monitoring-dashboard/frontend && npm run dev
# terminal 5 — run the pipeline
cd ai-model && python3 run_aegoria_demo.py --demothe --demo flag uses the synthetic dataset included in the rust engine so you don't need live system logs to see results.
after running the pipeline, you get:
- a security report stored in the database with full threat analysis
- a dashboard showing risk scores, AI classifications, alert details, and timelines
- a PDF report saved locally with system overview, threat intelligence, attack timeline, event distribution, and recommendations
- a terminal summary with the key findings
most security tools are either simple log viewers or opaque black boxes. aegoria tries to be neither.
the rust engine gives you fast, transparent detection with clear behavioral rules. the AI layer adds probabilistic scoring and learns from the data it sees. the secondary model watches the primary model itself — it's a detector that detects whether its own detection has been tampered with.
the whole thing connects through standard HTTP APIs, so each piece can run independently or be swapped out. the rust engine doesn't care that there's an AI layer downstream. the dashboard doesn't care where its reports come from. they just follow the data contract.
this project was built by a team of five people, Orlando, Anshuman, Jean-Michel, Jiahe & Linfeng, with backgrounds across cybersecurity, backend systems, machine learning, and frontend engineering. it started as a hackathon project during silicon days 2026 at GarageISEP and grew into a fully integrated system that actually runs end to end.
it's not perfect, and there are plenty of things we'd do differently next time. but it works, it connects, and it produces real results from real data — and that felt worth building.