Listen to this Post
Introduction:
In the high-stakes environment of a Security Operations Center (SOC), Tier 1 analysts are the first line of defense against phishing campaigns that bypass traditional email filters. The core challenge lies in rapidly triaging suspicious emails—parsing headers, extracting indicators of compromise (IOCs), and reaching a verdict before a user interacts with malicious content. The rise of accessible local Large Language Models (LLMs) like Llama 3.1 now allows security practitioners to build automated, privacy-preserving analysis tools that run entirely offline, eliminating the cost and data-exfiltration risks associated with cloud-based APIs.
Learning Objectives:
- Understand how to build a local, offline phishing email analyzer using Python, Streamlit, and Ollama.
- Learn to extract and parse key email artifacts (headers, body, attachments) to identify IOCs.
- Implement a local LLM (Llama 3.1 8B) to analyze email intent and generate a verdict with confidence scoring.
- Develop a batch-processing dashboard that displays verdict cards, extracted IOCs, and model reasoning for rapid SOC triage.
You Should Know:
- Setting Up the Local AI Environment with Ollama
The foundation of this offline analyzer is Ollama, a tool that allows you to run large language models locally. This approach is critical for SOC environments where sensitive email content cannot be sent to external APIs due to compliance and privacy regulations.
Start by installing Ollama on your system. For Linux (Ubuntu/Debian), use the following command:
curl -fsSL https://ollama.com/install.sh | sh
For Windows, download the installer from the official Ollama website. Once installed, pull the Llama 3.1 8B model, which is optimized for performance on consumer hardware:
ollama pull llama3.1:8b
This model provides a strong balance between reasoning capability and resource consumption, making it ideal for parsing email content and generating verdicts. After the download completes, you can test the model by running:
ollama run llama3.1:8b "Analyze this email for phishing intent: 'Your account has been compromised. Click here to verify.'"
The model should return a preliminary analysis, which you will later structure into a consistent verdict format.
- Parsing Email Files and Extracting Indicators of Compromise (IOCs)
The first step in the triage process is to parse raw email files (typically in `.eml` or `.msg` format) and extract structured data. In a Python script, you can use the `email` library to parse headers and body content. Here is a code snippet to get you started:
import email
from email import policy
from email.parser import BytesParser
import re
def parse_email(file_path):
with open(file_path, 'rb') as f:
msg = BytesParser(policy=policy.default).parse(f)
headers = {
'From': msg.get('From', ''),
'To': msg.get('To', ''),
'Subject': msg.get('Subject', ''),
'Date': msg.get('Date', ''),
'Return-Path': msg.get('Return-Path', ''),
'Reply-To': msg.get('Reply-To', '')
}
body = ""
if msg.is_multipart():
for part in msg.walk():
if part.get_content_type() == "text/plain":
body = part.get_content()
break
else:
body = msg.get_content()
Extract IOCs: URLs, email addresses, and IPs
urls = re.findall(r'(https?://[^\s]+)', body)
emails = re.findall(r'[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+.[a-zA-Z]{2,}', body)
ips = re.findall(r'\b(?:[0-9]{1,3}.){3}[0-9]{1,3}\b', body)
return headers, body, {'urls': urls, 'emails': emails, 'ips': ips}
This function provides a clean data structure that feeds into the LLM and the dashboard. For Windows environments, you can use PowerShell to extract similar metadata from `.msg` files using the `Outlook` COM object, though Python’s `extract-msg` library is a cross-platform alternative.
3. Crafting the Prompt for Consistent LLM Verdicts
One of the biggest technical hurdles is getting the LLM to return a single, clean verdict instead of a verbose or blended response. The solution lies in tightening the prompt structure. Here is an example prompt that forces the model to output a JSON object with a specific verdict:
def analyze_with_llm(headers, body, iocs):
prompt = f"""
You are a SOC Tier 1 analyst. Analyze the following email and return a JSON response with exactly these keys:
- "verdict": one of ["Phishing", "Suspicious", "Legitimate"]
- "confidence": an integer between 0 and 100
- "reasoning": a brief explanation of your decision
Email Headers: {headers}
Email Body: {body}
Extracted IOCs: {iocs}
Respond ONLY with the JSON object.
"""
Call Ollama via subprocess or API
import subprocess
result = subprocess.run(
['ollama', 'run', 'llama3.1:8b', prompt],
capture_output=True, text=True
)
return result.stdout
This structured approach minimizes hallucination and ensures that the output can be directly parsed and displayed in the Streamlit dashboard.
4. Building the Streamlit Dashboard for Batch Processing
Streamlit provides a rapid way to build a user interface for the analyzer. The dashboard should display verdict cards, confidence scores, extracted IOCs, and the model’s reasoning for each email. Additionally, it should support batch processing of multiple emails. Below is a skeleton of the app:
import streamlit as st
import json
from email_parser import parse_email
from llm_analyzer import analyze_with_llm
st.title("AI-Powered Phishing Email Analyzer")
uploaded_files = st.file_uploader("Upload email files", type=['eml', 'msg'], accept_multiple_files=True)
if uploaded_files:
for file in uploaded_files:
headers, body, iocs = parse_email(file)
verdict_json = analyze_with_llm(headers, body, iocs)
verdict = json.loads(verdict_json)
with st.expander(f"Email: {headers.get('Subject', 'No Subject')}"):
col1, col2 = st.columns(2)
with col1:
st.metric("Verdict", verdict['verdict'])
st.metric("Confidence", f"{verdict['confidence']}%")
with col2:
st.write("Extracted IOCs")
st.write(f"URLs: {iocs['urls']}")
st.write(f"Emails: {iocs['emails']}")
st.write(f"IPs: {iocs['ips']}")
st.write("Reasoning")
st.write(verdict['reasoning'])
To run the dashboard, execute:
streamlit run app.py
This provides a real-time, interactive interface that mirrors a SOC analyst’s workflow.
5. Integrating Threat Intelligence Feeds for Enrichment
While the LLM provides intent analysis, enriching the extracted IOCs with threat intelligence feeds adds another layer of verification. You can integrate free APIs like VirusTotal or AbuseIPDB, but remember that this may compromise the “offline” nature of the tool. For a purely offline approach, consider using local threat intelligence databases such as the `PhishTank` or `OpenPhish` dumps. Here is a simple enrichment function using a local CSV of known malicious domains:
import pandas as pd
def enrich_iocs(iocs):
df = pd.read_csv('malicious_domains.csv')
malicious_urls = [url for url in iocs['urls'] if any(domain in url for domain in df['domain'])]
return {'malicious_urls': malicious_urls}
This hybrid approach—combining local LLM analysis with static threat intelligence—provides a comprehensive verdict that a Tier 1 analyst can trust.
6. Handling Attachments and Embedded Scripts
A sophisticated phishing email often contains malicious attachments or embedded scripts. The analyzer should extract and optionally sandbox these attachments. For a lightweight solution, you can use the `python-magic` library to detect file types and `pyewf` or `oletools` to analyze macros in Office documents. Here is a basic attachment handler:
import magic def handle_attachment(part): filename = part.get_filename() if filename: content = part.get_payload(decode=True) file_type = magic.from_buffer(content) if 'Microsoft OLE' in file_type or 'PDF' in file_type: Run olevba or pdfid for deeper analysis pass return filename, file_type
This step is crucial for identifying weaponized documents that may bypass text-based analysis.
7. Deploying in a SOC Environment
For production deployment, consider containerizing the application using Docker to ensure consistency across environments. A sample `Dockerfile` would include:
FROM python:3.9-slim RUN apt-get update && apt-get install -y curl RUN curl -fsSL https://ollama.com/install.sh | sh COPY requirements.txt . RUN pip install -r requirements.txt COPY . . CMD ["streamlit", "run", "app.py", "--server.port=8501", "--server.address=0.0.0.0"]
This allows the tool to be deployed on a secure internal server, accessible only to the SOC team.
What Undercode Say:
- Key Takeaway 1: The combination of local LLMs with structured IOC extraction provides a cost-effective, privacy-preserving alternative to cloud-based phishing analysis tools, making it ideal for SOCs handling sensitive data.
- Key Takeaway 2: The biggest technical challenge—achieving consistent, single-verdict outputs from an LLM—can be overcome with rigorous prompt engineering and JSON-based response formatting, which reduces ambiguity and integrates seamlessly with downstream automation.
Analysis: This project demonstrates a significant shift in cybersecurity tooling: from expensive, API-dependent solutions to fully local, AI-driven workflows. By leveraging Llama 3.1 and Streamlit, the developer has created a tool that not only accelerates the triage process but also serves as an educational platform for aspiring SOC analysts. The emphasis on offline operation addresses a critical gap in the market, as many organizations are hesitant to send email content to third-party APIs due to data sovereignty and privacy concerns. Furthermore, the modular architecture allows for easy integration of additional threat intelligence feeds and custom rule sets, making it a versatile addition to any security stack.
Prediction:
- +1 The adoption of local LLMs for security analytics will accelerate as models become more efficient and quantization techniques improve, enabling even resource-constrained SOCs to deploy AI-driven triage tools.
- +1 Open-source projects like this will serve as blueprints for a new generation of “privacy-first” security tools, reducing reliance on commercial vendors and fostering innovation in the cybersecurity community.
- -1 As LLMs become more accessible, attackers will also leverage them to craft more sophisticated, context-aware phishing emails, potentially reducing the effectiveness of purely content-based analysis and requiring a shift towards behavioral and contextual detection methods.
▶️ Related Video (76% Match):
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Subhash Reddy – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
