Single-File Analysis
Built the initial workflow to validate and analyse one evidence file safely, including missing-file and size checks.
Automation / AI
AI-Assisted Homelab Analysis
A Python project that uses the OpenAI API to analyse and correlate technical evidence from my homelab and produce structured investigation reports.
PythonOpenAI APIGitNmapLDAPDNSSMB
Project Overview
What I set out to achieve
The project explores how an AI-assisted workflow can support technical evidence review without replacing the underlying investigation. The emphasis is on structured prompts, source evidence, repeatable processing and clearly stated limitations.
Environment
Technology and lab context
The tool runs on my Debian workstation inside a Python virtual environment. It accepts saved evidence files such as Nmap output, DNS SRV records, SMB security scans and LDAP RootDSE queries, then sends the combined evidence to the OpenAI API for analysis.
What I Did
Implementation and investigation
Structured Reports
Changed the analysis prompt to produce evidence type, observations, findings, severity, reasoning, recommended investigation and limitations.
Multi-Source Correlation
Expanded the script so multiple evidence files can be combined and analysed as a single investigation.
Git-Based Development
Used incremental commits to track changes and keep the project reproducible.
Troubleshooting
Challenges encountered
Input Validation
Handled missing, oversized, empty and invalid inputs before sending anything to the API.
Evidence vs Inference
Designed the report format to separate directly observed evidence from analytical conclusions.
API Failure Handling
Added error handling so credential or API failures do not result in misleading or partial reports.
Learning
What this project taught me
Python Automation
Improved practical Python skills through argument handling, file validation, API calls and report generation.
AI as an Analyst Tool
Learned that AI-assisted analysis is most useful when the evidence and reporting structure are constrained and auditable.
Correlation
Saw how multiple weak signals can become more meaningful when analysed together.
Evidence & Output
How the analysis workflow behaves
Multi-source evidence set
The project currently correlates several evidence types collected from the domain controller.
dc_quick_scan.nmap dc_ldap_srv.txt dc_smb_security.nmap dc_ldap_rootdse.txt
Keeping source files separate makes it easier to trace each analytical statement back to the underlying evidence.
Correlated finding
The combined report was able to connect independent evidence sources into one conclusion.
Observed: - DNS SRV records identify the domain controller - LDAP RootDSE identifies the naming context - TCP/88 confirms Kerberos - TCP/445 confirms SMB - SMB signing is enabled and required Finding: Evidence is consistent with an Active Directory domain controller with expected core services.
Input validation
The script handles invalid inputs before any API request is made.
Checks implemented: - Missing file - Oversized file - Empty file - Directory passed as input - Permission errors - Missing API credentials
This makes the workflow safer and prevents bad evidence from silently producing misleading reports.
Structured report design
The output format deliberately separates observations from interpretation.
Report sections: 1. Evidence type 2. Observations 3. Findings 4. Severity 5. Reasoning 6. Recommended investigation 7. Limitations
Problem → Investigation → Resolution example
Problem
Single-file analysis could not show relationships between DNS, LDAP, SMB and port-scan evidence.
Investigation
Reviewed how inputs were validated and how the analysis prompt received source evidence.
Resolution
Expanded the tool to accept multiple evidence files, label each source and generate a consolidated correlation report.
Next Steps
Where the project goes next
Add case-based project organisation, expand the evidence types, introduce stronger ATT&CK/CVE context where appropriate, and develop a repeatable post-incident analysis workflow.