PhantomTrace 👻: The Offline AI Forensic Detective Investigating Ghosts in System Logs

A developer built PhantomTrace, an offline, privacy-first AI digital forensics tool that ingests Linux, Windows and web system logs, normalizes them through a deterministic regex threat engine mapped to MITRE ATT&CK techniques, and reconstructs chronological attack timelines. The open-source MIT-licensed project pairs a FastAPI backend with a React dashboard and uses local open-weight inference via Ollama, with a zero-fail offline fallback engine, to generate grounded investigator chat and exportable PDF/JSON DFIR reports.

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 4: Ghost in the Machine https://dev.to/challenges/hacktoberfest-week4-2026-10-26 Every machine leaves a trace. Some tell a story. When a computer or cloud server is compromised, attackers don't just disappear—they leave behind faint digital apparitions: dozens of failed authentication attempts in the dead of night, an unusual sudo session opened by a low-privileged account, a sudden backdoor user added to /etc/passwd , and an attempt to erase audit logs. To seasoned SOC tier-3 analysts, these logs tell an obvious story. But for junior developers, sysadmins, and small open-source teams without dedicated security personnel, raw logs are intimidating walls of cryptic text. Existing SIEM tools will throw alerts, but reconstructing what happened, when it happened, and how the adversary navigated the system is agonizingly difficult. PhantomTrace is an offline, privacy-first AI digital forensics investigator that resurrects suspicious system activity and conducts an autonomous digital autopsy. Instead of another chatbot that writes Halloween ghost stories, PhantomTrace interprets the "Ghost in the Machine" theme through real-world cybersecurity: http://localhost:5173 ghost backdoor - crontab persistence. SeDebugPrivilege elevation - PsExec remote execution - wevtutil log clearing. The entire codebase is open-source under the MIT License: Hacktoberfest-Week4/ ├── backend/ │ ├── main.py FastAPI backend with CORS, streaming, & REST endpoints │ ├── detector.py Deterministic threat engine MITRE ATT&CK mapping & scoring │ ├── ollama client.py Ollama local LLM connector + Zero-fail offline DFIR engine │ ├── report generator.py Publication-ready PDF ReportLab & JSON export │ ├── samples.py Pre-loaded multi-stage attack scenarios │ └── requirements.txt Pure Python dependencies FastAPI, uvicorn, reportlab ├── frontend/ │ ├── src/ │ │ ├── components/ │ │ │ ├── Navbar.tsx Case status, Ghost Score pill, & engine indicator │ │ │ ├── SOCDashboard.tsx Metrics, Recharts attack vectors, & alert feed │ │ │ ├── EvidenceScanner.tsx 1-click scenario loader, file upload, & raw log paste │ │ │ ├── GhostTimeline.tsx Chronological attack graph with MITRE tactic tags │ │ │ ├── AIChatInvestigator.tsx Grounded forensic investigator chat with prompt chips │ │ │ ├── ForensicReport.tsx Official DFIR report, IOC table, & 1-click PDF export │ │ │ └── HauntedTerminal.tsx Retro CRT cyber terminal with real-time digital autopsy │ │ ├── types.ts TypeScript interfaces for all data structures │ │ ├── App.tsx Central state & scenario orchestrator │ │ └── index.css Cyber-obsidian & spectral emerald theme │ ├── package.json │ └── vite.config.ts ├── samples/ Standalone raw sample logs ├── run.bat 1-Click Windows launcher └── README.md Architecture, installation, & judge guide You can clone and run it with one command: git clone https://github.com/balabhadra3141/Hacktoberfest-Week4.git cd Hacktoberfest-Week4 .\run.bat Or cd backend && uvicorn main:app and cd frontend && npm run dev PhantomTrace combines a deterministic rule pipeline with local open-weight AI inference: System Logs Linux / Windows / Web │ ▼ ┌───────────────────────────┐ │ Log Normalization & │ │ Deterministic Rules │ ◄── Regex Threat Engine MITRE T1110, T1548, etc. └─────────────┬─────────────┘ │ ┌─────────────▼─────────────┐ │ Ghost Timeline Rebuilder │ ◄── Chronological Attack Sequences └─────────────┬─────────────┘ │ ┌────────────┴────────────┐ ▼ ▼ ┌──────────────────┐ ┌─────────────────────────┐ │ Local LLM │ │ Grounded Fallback │ │ Ollama/Qwen2.5 │ OR │ Offline Forensic Agent │ 100% Free / Zero Setup └────────┬─────────┘ └────────────┬────────────┘ │ │ └─────────────┬───────────────┘ │ ┌───────────────┼───────────────┐ ▼ ▼ ▼ ┌──────────────┐ ┌─────────────┐ ┌───────────────┐ │ SOC Console │ │ AI Chat Q&A │ │ PDF / JSON │ │ & Terminal │ │ Investigator│ │ Report Export │ └──────────────┘ └─────────────┘ └───────────────┘ A major risk in AI cybersecurity is hallucination—an LLM imagining an attack or inventing a fake IP address. PhantomTrace solves this through a two-stage pipeline: detector.py uses high-speed regex pattern matching to parse Linux syslog/auth.log, Windows EVTX-exported events, and Web server access logs. It identifies confirmed threat indicators SSH brute force, sudo elevation, rogue accounts and tags them with official T1110.001 , T1548.003 , T1136.001 , T1070.001 . PhantomTrace connects directly to a locally hosted Ollama instance http://127.0.0.1:11434 using open-weight models such as qwen2.5:3b or llama3.2 . Built with React 19 , TypeScript , Tailwind CSS , and Recharts : In digital forensics and cybersecurity, open innovation is not just a preference—it is a non-negotiable architectural requirement. System logs contain some of the most sensitive data an organization possesses: private IP architectures, internal hostnames, user credentials, failed passwords, and command histories. Sending raw production authentication logs to a proprietary, cloud-hosted closed API like OpenAI or Anthropic violates compliance standards GDPR, HIPAA, SOC 2 and actively creates a new data-exfiltration risk. With open-weight models and Ollama , PhantomTrace operates completely offline. You can disconnect your ethernet cable, turn off Wi-Fi, and run an in-depth forensic investigation on an air-gapped laptop in a data center. Closed AI APIs are black boxes that can change, deprecate models, or alter safety guardrails overnight. In forensic investigations where evidence might be presented in court or an insurance audit, you need predictable, auditable, deterministic inference. Open-source models can be versioned, inspected, fine-tuned, and verified locally. Small startups, non-profits, independent developers, and open-source maintainers cannot afford enterprise SIEM subscriptions that charge thousands of dollars per gigabyte of ingested logs. PhantomTrace proves that open-source AI and deterministic engineering can give anyone an enterprise-grade digital forensic investigator for $0 . This entire application—from backend threat rules and Ollama integration to the React dashboard, timeline graph, and PDF report generator—was developed through an agentic pair-programming session with Antigravity . The workflow: The moment this project truly came alive was when we tested the Haunted Terminal Mode on the Linux Server Breach dataset: ╔══════════════════════════════════════════════════════════════════════╗ ║ PHANTOMTRACE FORENSIC KERNEL v1.0.0-HACKTOBERFEST ║ ║ Every machine leaves a trace. Some tell a story. ║ ╚══════════════════════════════════════════════════════════════════════╝ PHANTOMTRACE Initializing Spectral Memory Extraction... Probing kernel ring buffer and forensic event journals... Captured 14 spirit traces across system bus. DANGER: Detected 5 paranormal security deviations Spectral Origin Located: Foreign IP entity 198.51.100.42 manifesting on port 22. Trace 1: SSH Brute Force Attack 5 attempts T1110.001 ↳ Whisper: Detected 5 failed authentication attempts originating from IP 198.51.100.42. 💀 THE GHOST BREACHED THE GATE: Authentication barrier collapsed 💀 GHOST ELEVATION: The entity possessed root UID 0 permissions 💀 PHANTOM RESIDUE: Adversary left a rogue soul in the user registry Forensic timeline sealed. Digital autopsy complete. Watching cryptic log lines transform into a coherent, gripping narrative—not as fictional fantasy, but as an accurate, MITRE-mapped autopsy of a real cyber incursion—made it clear: AI doesn't just need to generate text; it can give eyes and ears to systems that were previously silent. Built with ❤️ for Hacktoberfest 2026. Every machine leaves a trace. Some tell a story. 👻