Projects
Featured Project
SOC Alert-Triage Copilot
An AI agent that investigates security alerts like a junior analyst, and shows its work.
- Problem
- Security teams get far more alerts than they can work by hand, and most turn out to be false positives. Triaging each one is slow, repetitive, and easy to get wrong when the volume is high.
- Approach
- I built an agent that works an alert the way a junior analyst would: it gathers evidence from several sources, reasons over what it finds, and commits to a verdict, while keeping the full evidence trail visible so a human can check the call.
- What I built
- A Node.js command-line tool on the Anthropic API. A five-tool agent looks up IP reputation, maps activity to MITRE ATT&CK, correlates related alerts, and pulls user context, then a forced submit_verdict step returns clean, machine-readable output. It runs a single alert or a whole queue, and a browser dashboard replays the queue as a live shift report.
- Result
- It triages a 20-alert synthetic SIEM dataset into structured verdicts, each backed by its own evidence trail, at about four cents per alert. When a case is genuinely ambiguous, it escalates to human review instead of forcing a confident answer it cannot support.