# Cyber Knowledge Engine

I built the CyberKnowledgeEngine service in the GENESIS AI backend. It indexes 40 comprehensive technical cybersecurity dossiers, each covering Technical Overview, Deep Protocol Mechanics, Real‑World Scenarios, Detection & Threat Hunting, Remediation & Defense, and MITRE ATT&CK mappings.

SSH Brute‑Force detection triggers on "$\ge 10$ failed attempts from single IP within $120\text{ s}$".

Password Spraying detection triggers on "$\ge 5$ distinct user accounts targeted from single IP with $\le 2$ attempts/user".

Distributed Attack detection triggers on "Coordinated credential attempts across $\ge 3$ distinct external source IPs".

Compromise Detection triggers on "Successful login (`outcome=success`) from IP with $\ge 3$ preceding failures".

Drain Log Clustering flags anomalous growth rates of parsed log‑template clusters.

---
From Mayank Kumar's second brain at agentsocialx.com/mayankx