Open Source · Multi-Cloud Architecture · v1.0.0

HOLLOW
PURPLE

An autonomous cloud identity defense platform that watches attackers move through a maze — then moves the walls. Built with AI, deception engines, and graph intelligence across AWS, GCP, Azure, and FreeBSD.

⌖ Launch SOC Console View on GitHub → Platform Docs ↗
MIT License Python 3.11+ FastAPI · PyTorch · Neo4j AWS · GCP · Azure · FreeBSD
Autonomous Defense Engine

Live Operational Working Model

Direct execution of the Hollow Purple algorithms. Select a multi-cloud vector or enter custom credentials to compute Shannon entropy drift, traverse identity blast radius, mint cryptographic canary tokens, and inspect real mitigation directives.

ENGINE ACTIVE (v1.0.0) Open Full SOC Console →
Cloud Vectors:
Ready for evaluation
Principal / Identity Subject AWS IAM
Action / API Call Vector Action
Source IP / CIDR
Target Crown Jewel
Autonomous Defense Policy Mode
78%
Blast Radius
+3.42 H
Entropy Drift
2 Hops
Distance to Jewel
QUARANTINE
Model Decision
get started in 30 seconds
$ git clone https://github.com/Tejaswanth2406/hollow-purple.git

or download the ZIP · no account required

3
AI Layers
47s
Avg. Time to Neutralize
0
Real Records Exfiltrated (in tests)
MIT
License — Free Forever
what it does

Defense that thinks before it acts

Hollow Purple doesn't just alert. It observes, decides, deceives, and neutralises — without touching production systems until it's sure.

🕸
Identity Graph Engine
Maintains a live temporal graph of every identity, role, and privilege edge across AWS, GCP, and Azure. Watches how the graph moves in real time.
🧠
AI Threat Detection
A Graph Neural Network (GNN) trained on attack topologies spots lateral movement patterns before a human analyst would see the shape.
🎭
Deception Engine
When risk crosses 0.7, attackers are silently redirected to a convincing fake environment. They think they won. Every move is recorded.
⚖️
MAHORAGHA Governance
Zero auto-apply to production. Every mutation is proposed, explainability-scored, and gated behind a human decision. Always advisory.
🔗
Merkle Audit Log
Every event, every decision, every session is hash-chained into a tamper-evident Merkle log. Replay any point in time to the millisecond.
🤖
RL Defense Agent
A PPO-trained reinforcement learning agent continuously improves its response strategy — picking the lowest-blast-radius action every time.
the pipeline

From raw event to neutralised threat

Eight stages. One continuous loop. Attacker never reaches real data.

01
Cloud Event
AWS · GCP · Azure
02
Ingestion
Normalise · Validate
03
Graph Update
Identity · Roles · Edges
04
GNN Scores
Pattern recognition
05
Bayesian Risk
Propagate · Quantify
06
RL Agent Acts
Lowest blast radius
07
Deception / Isolate
Cage or cut
08
Merkle Sealed
Tamper-proof log

Full walkthrough in the README · Average latency from event to action: ~47ms

built with

Production-grade open-source stack

No proprietary dependencies. Swap out any layer with your own tooling.

Python 3.11+ FastAPI PyTorch PyTorch Geometric Stable-Baselines3 NetworkX PostgreSQL Redis Neo4j DuckDB InfluxDB Prometheus AWS CloudTrail GCP Audit Logs Azure Monitor
open source · free forever

Download it.
Wire it up.
Move the walls.

Hollow Purple is MIT-licensed and built to be self-hosted. No SaaS, no subscription, no vendor lock-in. Clone it, configure your cloud credentials, and run it.

↓ Download ZIP ☆ Star on GitHub Read the Docs

MIT License · No telemetry · No phone-home · Self-hosted