The Problem
Security teams are buried in noise — disparate consoles, alert fatigue, and slow human triage. Decisions that should take seconds take hours.
The Solution
A unified, opinionated dashboard that ingests SIEM streams, enriches every event with threat intel, and uses an LLM-powered triage layer to rank, cluster, and explain incidents in plain English — so analysts focus on response, not parsing.
Key Features
Sub-second ingestion via WebSockets with on-the-fly correlation across log sources.
An LLM scoring model that ranks alerts, clusters duplicates, and writes a one-line summary per incident.
Animated globe pinpointing attacker origins, with great-circle arcs showing campaign spread.
One-click response actions — quarantine host, rotate keys, open ticket — with audit trail.
Reconstructs the kill-chain for any incident with packet, log, and process evidence side-by-side.
Tailored surfaces for analysts, IR leads, and executives — same data, three altitudes.
Architecture
- 1Edge gateway authenticates clients and fans out a single WebSocket multiplex per analyst.
- 2Stream processors enrich raw SIEM events with threat-intel feeds (MISP, AbuseIPDB) before persisting to ClickHouse.
- 3An async LLM worker scores and summarizes events; results cached in Redis to avoid recomputation.
- 4React Server Components handle the heavy historical views; live tiles hydrate over the WS multiplex.
Outcomes
Highlights
- Zero-trust auth across the entire surface
- Air-gapped deployment supported
- Replayable forensic timelines
- Cinematic UI built for 24/7 SOC walls