NetCanvas

AI-powered network incident analysis. Describe an incident in plain English, get context-specific diagnostic widgets — traffic charts, severity scores, runbooks, query suggestions, and more.

Architecture

┌─────────────────────────────────────────────────────────┐
│                   Next.js Frontend                       │
│  ┌──────────┐ ┌──────────────────────────────────────┐  │
│  │ Incident  │ │          Widget Grid                  │  │
│  │ Input     │ │ Traffic │ Severity │ Runbook │ Query  │  │
│  └──────────┘ │ Geo Map │ Protocol │ Timeline│ Assets │  │
│               └──────────────────────────────────────┘  │
│  ┌──────────────────┐  ┌──────────────────────────┐     │
│  │ Security Badge    │  │ Audit Log Panel          │     │
│  └──────────────────┘  └──────────────────────────┘     │
├─────────────────────────────────────────────────────────┤
│                   FastAPI Backend                        │
│  ┌────────────┐ ┌──────────────┐ ┌─────────────────┐   │
│  │ Claude API  │ │ Prompt Inj.  │ │ SQLite Audit    │   │
│  │ NL Parsing  │ │ Classifier   │ │ Log             │   │
│  └────────────┘ └──────────────┘ └─────────────────┘   │
├─────────────────────────────────────────────────────────┤
│  Synthetic Data Generator (50+ incidents, 8 types)      │
└─────────────────────────────────────────────────────────┘

Quick Start

Backend

cd backend
pip install -e ".[dev]"

# Set your API key
export NETCANVAS_ANTHROPIC_API_KEY=sk-ant-...

# Run the server
uvicorn netcanvas.main:app --reload --port 8000

Frontend

cd frontend
npm install
npm run dev    # http://localhost:3000

Widget Types

Widget	Description
Traffic Anomaly Chart	Line chart of traffic with anomaly markers
Threat Severity Score	0-100 score with contributing factors
Runbook Suggestion	Step-by-step incident response
Investigation Query	SIEM/DB query for further investigation
Geographic Heatmap	Source traffic by location
Protocol Breakdown	Protocol distribution pie chart
Event Timeline	Chronological incident events
Affected Assets	Impacted systems and their status

Security Layer

Every LLM call is inspected:

• Input scanning: Prompt injection classifier with 20+ regex patterns
• Output scanning: Anomalous output detection
• Audit logging: Every call, scan result, and latency logged to SQLite
• Visible in UI: Security badge and audit log panel

Telemetry Swap-In Path

The backend is built on synthetic data but designed for real Cisco telemetry:

1. Replace synthetic_data.py with a real data connector
2. Update llm.py system prompts with actual field names
3. Add authentication middleware for Cisco SSO
4. Point widget data sources to real SIEM/NMS APIs

No architectural changes required — the NL parsing and widget rendering layers are data-source agnostic.

License

MIT