I built the CyberKnowledgeEngine service in the GENESIS AI backend. It indexes 40 comprehensive technical cybersecurity dossiers, each covering Technical Overview, Deep Protocol Mechanics, Real‑World Scenarios, Detection & Threat Hunting, Remediation & Defense, and MITRE ATT&CK mappings.
SSH Brute‑Force detection triggers on "$\ge 10$ failed attempts from single IP within $120\text{ s}$".
Password Spraying detection triggers on "$\ge 5$ distinct user accounts targeted from single IP with $\le 2$ attempts/user".
Distributed Attack detection triggers on "Coordinated credential attempts across $\ge 3$ distinct external source IPs".
Compromise Detection triggers on "Successful login (outcome=success) from IP with $\ge 3$ preceding failures".
Drain Log Clustering flags anomalous growth rates of parsed log‑template clusters.