Security Operations / AI

SecOps AI

A multi-user, analyst-grade SOC investigation platform that connects raw log activity into correlated incidents, attacker stories, and reviewable cases.

Status
Implemented
Core stack
FastAPI · Next.js · PostgreSQL
Data paths
Log uploads · WebSocket ingestion · GeoIP enrichment
Role
Investigation support—not analyst replacement

Alerts are fragments. Investigations need a narrative.

Security logs rarely explain an incident on their own. A brute-force pattern, a successful login, endpoint probing, and an injection attempt may arrive as separate events even when they belong to the same campaign.

SecOps AI was built to move beyond isolated alert presentation. It parses events, creates detections, correlates related behavior, applies a canonical risk view, and gives analysts a persistent case and timeline for investigation.

Designed for analyst support.

AI adds context and next-step guidance; the platform does not position automated interpretation as a replacement for professional judgment.

From raw events to an investigation record.

Investigation pipeline

Logs / Live Stream
Parsing
Detections
Correlation
Attack Campaigns
Risk Engine
AI Analyst Context
Case / Timeline / Report

Connecting activity into an attacker story.

Detection coverage

Surfaces brute force, 404 scanning, multi-endpoint probing, path traversal, SQL injection, command injection, and suspicious user agents.

Compromise correlation

Connects failed-login sequences to later success and groups related activity into attack campaigns.

Persistent investigations

Supports cases, multi-session investigation history, suspicious-activity timelines, SOC-style search, and case sharing.

Operational output

Adds AI explanation and next steps, executive views, alerts, configurable detection rules, and PDF reporting.

A workspace for different investigation modes.

The frontend separates overview, investigation, live monitoring, case management, executive reporting, rules, and settings so analysts can move between immediate signal review and deeper, persistent work without losing context.

  • Authentication and API keys support multi-user access patterns.
  • Uploaded Apache/Nginx-style logs and real-time WebSocket ingestion share a common investigation model.
  • GeoIP enrichment adds useful location context without replacing primary event evidence.
  • Alerting and rule configuration keep detection behavior visible and adjustable.

Built for persistent security operations.

Backend

FastAPI · Authentication · API keys · WebSockets

Frontend

Next.js · Analyst workflows · Live monitor · Executive views

Persistence

PostgreSQL · Cases · Sessions · Investigation history

Analysis

Parsing · Detection rules · Campaign correlation · GeoIP · AI context