□ 基于 Docker 为 Linux 设计的 AI 安全分析实验室

包括(ALL LOCAL)

• Ollama(v0.3.12)-本地LLM推论服务器
• Bifrost - LLM网关,设有多供应商路由、审计记录和UI
• LiteLLM - OpenAI兼容自定义回调的LLM代理网关
• ** Ollama MCP 服务器** - 模式背景协议与JSON-RPC记录集成
• Promptfoo - LLM评价和OWASP LLM Top 10安全测试
• ** OpenWebUI** - AI互动的网络界面
• ** Splunk** – – 安全信息和事件管理
• ** Splunk 通用转发器** - 企业级日志收集
• ** 技术附加** - TA-ollama、TA-mcp-jsonrpc、TA-llmgateway符合CIM要求

□ MITRE ATLAS 重点检测开发实验室 这个实验室旨在以MITRE ATLAS框架为基础开发AI/ML安全检测.

– – . . .

□ 快开始

· 先决条件

• Linux(16 GB RAM + GPU推荐)——在Ubuntu 24.04.2 LTS上测试.
• ** Docker引擎和 Docker编曲**
• 插头组中的用户:sudo usermod -aG docker $USER

QQ 设置

1. ** 设立存储处**

2. ** 特定环境变量**

3. ** 启动实验室**

4.四.

SPLUNK MCP / LLM SIEMulator by Rod Soto - Linux Version (v3.1)

Docker-based AI Security Analysis Lab for Linux

Includes (ALL LOCAL)

• Ollama (v0.3.12) - Local LLM inference server
• Bifrost - LLM gateway with multi-provider routing, audit logging, and UI
• LiteLLM - OpenAI-compatible LLM proxy gateway with custom callbacks
• Ollama MCP Server - Model Context Protocol integration with JSON-RPC logging
• Promptfoo - LLM evaluation and OWASP LLM Top 10 security testing
• OpenWebUI - Web interface for AI interactions
• Splunk - Security information and event management
• Splunk Universal Forwarder - Enterprise-grade log collection
• Technology Add-ons - TA-ollama, TA-mcp-jsonrpc, TA-llmgateway with CIM compliance

MITRE ATLAS Focused Detection Development Lab

This lab is designed for developing AI/ML security detections based on the MITRE ATLAS framework.

---

Quick Start

Prerequisites

• Linux (16 GB RAM + GPU recommended) — tested on Ubuntu 24.04.2 LTS
• Docker Engine and Docker Compose
• User in docker group: sudo usermod -aG docker $USER

Setup

1. Clone the repository

   git clone 
   cd splunk-mcp-llm-siemulator-linux
   

2. Set environment variable

   export SPLUNK_HEC_TOKEN=f4e45204-7cfa-48b5-bfbe-95cf03dbcad7
   

3. Start the lab

   docker compose up -d
   

4. Wait for Splunk to fully initialize (look for “Ansible playbook complete”)

   docker compose logs -f splunk
   

5. Pull the LLM model (first time only)

   docker exec security-range-ollama ollama pull llama3.2
   

6. Access Splunk: http://localhost:8000 (admin / Password1)

---

Architecture Overview

+---------------------------+     +---------------------------+     +-------------------+
|        Ollama LLM         |     |       MCP Server          |     |    Promptfoo      |
|       (port 11435)        |     |      (port 3456)          |     |   (host network)  |
+------------+--------------+     +------------+--------------+     +-------------------+
             |                                 |
             |          |
             |                                 |
+------------+--------------+     +------------+--------------+
|   Bifrost LLM Gateway     |     |  LiteLLM LLM Gateway     |
|       (port 8090)         |     |      (port 4001)         |
|  logs.db → hec_shipper    |     |  custom_callbacks.py     |
+------------+--------------+     +------------+--------------+
             |  HEC                            |  HEC
             v                                 v
+------------------------------------------------------------------+