🔬 Forensic MCP + Bedrock Assistant

AI-powered digital forensics assistant combining Model Context Protocol (MCP) with Amazon Bedrock for intelligent cybersecurity investigations.

🚀 Quick Start

# Install dependencies
pip install -r requirements.txt

# Configure AWS credentials
aws configure

# Run the assistant
python bedrock_mcp_client.py

🎯 What It Does

This tool provides 5 specialized forensic capabilities powered by AI:

Tool	Purpose	Use Case
analyze_log_file()	Security log analysis	Detect attack patterns, brute force attempts
check_ip_reputation()	IP threat intelligence	Verify malicious IPs, get geo info
extract_iocs()	IOC extraction	Find IPs, domains, hashes, URLs in text
generate_timeline()	Incident timeline	Reconstruct attack chronology
generate_incident_report()	Executive reporting	Professional incident summaries

📋 Requirements

• Python 3.8+
• AWS Account with Bedrock access
• MCP Library: pip install mcp
• AWS SDK: pip install boto3

🔧 Setup

1. Install Dependencies

pip install -r requirements.txt

2. AWS Configuration

aws configure
# Enter your AWS credentials
# Region: us-east-1 (recommended)

3. Test Installation

python -c "from bedrock_mcp_client import ForensicMCPClient; print('✅ Ready')"

💡 Usage Examples

Interactive Mode

python bedrock_mcp_client.py --interactive

Programmatic Usage

from bedrock_mcp_client import ForensicMCPClient

async def analyze_incident():
    async with ForensicMCPClient("forensic_mcp_server.py") as client:
        await client.connect_to_mcp_server()
        
        result = await client.query_bedrock(
            "Analyze security logs for suspicious authentication patterns"
        )
        print(result)

Common Investigation Workflow

# 1. Analyze suspicious logs
log_analysis = await client.query_bedrock(
    "Analyze /var/log/auth.log for brute force attacks"
)

# 2. Check IP reputation
ip_check = await client.query_bedrock(
    "Check reputation of IP 192.168.1.100"
)

# 3. Extract IOCs
iocs = await client.query_bedrock(
    "Extract all IOCs from the analyzed logs"
)

# 4. Generate timeline
timeline = await client.query_bedrock(
    "Create incident timeline for the last 24 hours"
)

# 5. Create executive report
report = await client.query_bedrock(
    "Generate incident report INC-2025-001"
)

🛠️ Architecture

┌─────────────────┐    ┌──────────────────┐    ┌─────────────────┐
│   User Query    │───▶│  Bedrock Client  │───▶│  Amazon Bedrock │
└─────────────────┘    └──────────────────┘    └─────────────────┘
                                │
                                ▼
                       ┌──────────────────┐
                       │   MCP Server     │
                       │  (5 Forensic     │
                       │   Tools)         │
                       └──────────────────┘

🔍 Tool Details

analyze_log_file()

• Input: File path, analysis type
• Output: Risk score, findings, recommendations
• Detects: Brute force, malware execution, lateral movement

check_ip_reputation()

• Input: IP address
• Output: Threat classification, geo info, recommendations
• Sources: Built-in threat intelligence database

extract_iocs()

• Input: Text content
• Output: IPs, domains, hashes, URLs, emails
• Features: Automatic threat classification

generate_timeline()

• Input: Incident data, time window
• Output: Chronological event sequence
• Analysis: Attack phases, evidence correlation

generate_incident_report()

• Input: Incident ID, analysis data
• Output: Executive summary, technical details
• Format: Professional incident response report

🚨 Troubleshooting

Common Issues

❌ "MCP library not found"

pip install mcp

❌ "Access denied to Bedrock"

# Check AWS credentials
aws sts get-caller-identity

# Verify Bedrock access
aws bedrock list-foundation-models --region us-east-1

❌ "Server connection failed"

# Start MCP server first
python forensic_mcp_server.py

# Then run client
python bedrock_mcp_client.py

Debug Mode

export LOG_LEVEL=DEBUG
python bedrock_mcp_client.py --interactive

📊 Project Structure

forensic-mcp-bedrock/
├── bedrock_mcp_client.py      # Main client with Bedrock integration
├── forensic_mcp_server.py     # MCP server with forensic tools
├── requirements.txt           # Python dependencies
└── README.md                  # This file

📄 License

MIT License - see LICENSE for details.

---

🕵️ Happy investigating with AI-powered forensics!

Built for the cybersecurity community