SwarmOps AD Agent — AI-Monitored Active Directory with Human Approval Gate
A local AI agent that watches your Active Directory event logs, triages anomalies, and drafts PowerShell remediation tickets — then stops and waits for you to decide. Nothing executes automatically. Ever.The agent writes. You decide.Most IT shops catch AD anomalies too late — buried in a SIEM, flagged after the damage, or never noticed at all. This template puts a two-model AI triage layer in front of your Windows Security Event Log and delivers a drafted remediation ticket to your approval queue before you've finished your coffee.It runs entirely on your machine with Ollama. No cloud. No API costs. No data leaving your building.---What it monitors:- Failed logon storms (4625)- Account lockouts and lockout storms (4740)- Privilege group membership changes (4728, 4732, 4756)- New user creation and deletion (4720, 4726)- Special privileges assigned (4672)- Explicit credential logons (4648)- NTLM validation spikes (4776)---How it works:1. Qwen (1.5B, Tier 1) triages each event — severity + confidence score2. Low confidence → pauses and asks you: escalate or skip3. High confidence anomaly → Llama (3B, Tier 2) writes a 3-point PowerShell remediation ticket4. You approve or skip. Approved tickets land in dispatched_drafts/---Four governance controls — built in:┌──────────────────┬──────────────────────────────────────────────────────────────┐│ Control │ What It Does │├──────────────────┼──────────────────────────────────────────────────────────────┤│ Scope file │ Allow-list of what the agent can analyze. Missing = won't ││ │ start. │├──────────────────┼──────────────────────────────────────────────────────────────┤│ Kill switch │ Drop a file to stop the engine cleanly mid-run. │├──────────────────┼──────────────────────────────────────────────────────────────┤│ Audit log │ Append-only record of every event, triage, and operator ││ │ decision. │├──────────────────┼──────────────────────────────────────────────────────────────┤│ Approval │ Agent output lands in a draft folder. Nothing executes ││ boundary │ without you. │└──────────────────┴──────────────────────────────────────────────────────────────┘---What's included:- orchestrator_ad.py — the agent engine- generate_ad_events.py — test event generator (simulate lockout storms, privilege changes, all 10 event types — no live DC required)- watch_folder/ — drop your exported Security log here for live monitoring- dispatched_drafts/ — where approved tickets are archived- README.md — full setup guide, 4 steps, under 30 minutes- SCOPE.md — pre-configured governance file, edit to match your policy---Requirements:- Python 3.10+- Ollama running locally- qwen2.5-coder:1.5b and llama3.2:3b pulledSetup time: Under 30 minutes if Ollama is already installed.---Who this is for:Sysadmins and IT ops engineers who want AI watching their AD environment — without giving AI the keys to fix anything on its own.Built on SwarmOps Core — the governance-first AI framework for IT operations.
Get it → joatsaint.gumroad.com