quiet signal

~/projects/soc-alert-dashboard

SOC alert triage dashboard

Simulated Runs on synthetic data created for demonstration. Not from a real environment.

An in-browser alert queue with filtering, MITRE ATT&CK mapping and a triage panel that explains each disposition. Runs on synthetic alerts.

Tools: TypeScript, Astro, Vitest

Open the live demo

Alert triage flow An alert is checked for plausibility, mapped to a MITRE ATT&CK technique, and given a disposition. False positives and benign activity are closed and the rule tuned. True positives are contained and escalated. Alert fires rule + raw event Plausible? normal for host/user Map technique MITRE ATT&CK Disposition decide and record why Close and tune false positive, benign Contain, escalate true positive
Every alert in the demo is worked through these steps. The triage panel shows the reasoning at each one.

What it shows

A tier 1 analyst’s day is mostly a queue: read the alert, decide whether it’s real, decide what happens next, and write down why. This demo recreates that queue with eighteen synthetic alerts, written to resemble what Sysmon, Windows Security logging, a web proxy and an identity provider would produce.

Open the SOC lab to use it.

Triage approach used for every alert

  1. What fired? The rule name and the raw event that triggered it.
  2. Is it plausible? Compare against what is normal for that host and user.
  3. What technique does it map to? A MITRE ATT&CK technique gives a shared vocabulary for the behavior.
  4. Disposition. True positive, benign true positive, false positive, or escalate.
  5. Next steps. What a responder should do now, in order.

How it’s built

export function sanitizeQuery(raw: unknown, maxLength = 100): string {
  if (typeof raw !== 'string') return '';
  return raw
    .replace(/[\u0000-\u001f\u007f]/g, '')
    .trim()
    .slice(0, maxLength)
    .toLowerCase();
}

Limits

The data is invented. The dispositions are written as teaching notes, not as output from a real detection engine. The value here is the triage reasoning, which is mine to explain in an interview.