// cat ./projects/specterheal.md
SpecterHeal
AI-Assisted Self-Healing Infrastructure
An autonomous remediation orchestrator pairing Lynis auditing with Ollama-driven reasoning, executing dynamic Ansible playbooks against drifted hosts under human approval gates.
## Problem
Hardening reports rot the moment they're filed. Drift accumulates between audits, and engineers spend their cycles re-applying the same fixes across fleets.
## Architecture
Lynis audits each host on a schedule. Findings are passed to a local Ollama model that classifies severity and proposes remediation steps. Those steps are templated into Ansible playbooks and executed against the target with full audit logging.
## Human-in-the-Loop
A Streamlit dashboard surfaces fleet-wide posture, queued remediations, and AI confidence per finding. Operators approve high-impact changes; low-risk drift heals itself. Every action is reversible via generated rollback plays.
## Lessons Learned
Marketing this as 'AI fixes servers' was the wrong frame. Reframing it as 'AI-assisted remediation orchestration' kept operators in control and made the platform actually shippable.
## Roadmap
Pluggable scanners beyond Lynis (Wazuh, OpenSCAP), confidence calibration on remediation outcomes, and a policy DSL for per-host auto-approve thresholds.
// ls ../
FLAGSHIP
Snock →
Autonomous Cloud Security AI Agent
PRODUCTION
Enterprise DDoS Defense →
AWS Shield Advanced & Firewall Manager Automation
PRODUCTION
Hardened GitLab DevSecOps Platform →
Secure CI/CD with Terraform, tfsec, Trivy, SonarQube
ENGAGEMENT
Trend Micro XDR Remediation →
Enterprise Endpoint Detection & Response Tuning
PRODUCTION
AWS Incident Response Automation →
Event-Driven Containment with Lambda + CloudWatch
PRODUCTION
SOC Automation & Visualization →
TheHive + Elasticsearch + Grafana + n8n
PRODUCTION
Fortinet SD-WAN Deployment →
Resilient Multi-Site Connectivity
INTERNAL
CTF Training Platform →
Practical Cybersecurity Training Lab
PRODUCTION
Cloud Monitoring & Observability Platform →
Terraform, ECS Fargate, cross-account CloudWatch
DELIVERED
CIS Benchmark & Remediation Program →
Measured posture improvement across a DevOps platform
DELIVERED
Open Banking Auth Flow Load Testing →
k6, mTLS, FAPI/OAuth2 with PAR, browser-driven SCA