My Role
Security product designer and full-stack engineer
All Projects
Interactive simulationFlagship case study
Aegis SOC Analyst
AI-Driven Security Operations Center
SOC analysts need to turn noisy telemetry into prioritized, explainable incidents without losing the evidence behind each decision.
Interactive preview
Full demoWhat I Built
Production-grade SOC platform built on Next.js 16, Prisma, and PostgreSQL that normalizes telemetry from firewall, cloud, Active Directory, Linux, and EDR sources into a single event schema, correlates it with MITRE ATT&CK detection rules, and promotes related alerts into scored incidents. An AI analyst layer writes the attack narrative, severity rationale, and containment recommendations, and a threat-hunting console runs a parsed query language against the event store.
Evidence
Working interface, documented system behavior, and implementation-level decisions.
Technical Architecture
From system input to explainable output.
The control gate is shown as a first-class stage, not an afterthought added around the workflow.
Technical Decisions
- Built a full security operations console on Next.js 16 App Router with React 19, server actions, Prisma 7, and PostgreSQL, covering dashboard, alerts, incidents, events, detections, entities, sources, users, search, and audit surfaces.
- Designed a normalized event schema that flattens Windows, Linux, firewall, cloud, Active Directory, endpoint, network, and application logs into shared fields (user, source and destination IP, host, process, parent process, command line, action, status, geolocation) while retaining the raw message for analyst review.
- Implemented a detection rule engine mapped to real MITRE ATT&CK tactics and techniques, including impossible travel followed by privilege escalation, encoded PowerShell execution, password spraying against directory services, Office spawning a script interpreter, mass file access consistent with staging, and cloud access keys created outside the change window.
- Built an AI analyst layer that produces the attack narrative, severity rationale, MITRE mapping, confidence score, and prioritized containment recommendations per incident, persisted alongside the incident and served through an interactive chat surface for follow-up triage questions, behind a configurable provider setting (Anthropic or OpenAI).
Security Considerations
- Built a full security operations console on Next.js 16 App Router with React 19, server actions, Prisma 7, and PostgreSQL, covering dashboard, alerts, incidents, events, detections, entities, sources, users, search, and audit surfaces.
- Modeled alert-to-incident promotion with risk scoring, severity ranking, and triage workflow states (new, investigating, resolved, false positive) so correlated alerts roll up into one investigable incident.
- Built an AI analyst layer that produces the attack narrative, severity rationale, MITRE mapping, confidence score, and prioritized containment recommendations per incident, persisted alongside the incident and served through an interactive chat surface for follow-up triage questions, behind a configurable provider setting (Anthropic or OpenAI).
- Wrote a threat-hunting query language over the event store with an allow-listed field map, negation, relative time windows, and quoted phrases that compiles to Prisma where clauses, so no user input is ever concatenated into SQL.
Outcome & Evidence
- Added simulated response actions (block IP, revoke sessions, isolate host) that record executing identity, target, outcome, and timestamp into an immutable audit log.
- Built the visualization layer with Recharts and Framer Motion, restricting saturated color to severity so the palette itself carries analyst meaning.
- Shipped a Docker Compose Postgres service and a Prisma seed that generates realistic baseline noise plus staged multi-step attack chains, so the whole console comes up reproducibly from a clean database.
SIEMDetection EngineeringMITRE ATT&CKIncident ResponseThreat HuntingNext.jsPrismaPostgreSQLRBAC
Working product
Try the interactive demo.
The product experience is part of this case study. Explore it here, reset its state, or switch viewport sizes without leaving the project page.
aegis-soc-analyst.zainkhalilkhan.com
This is the actual deployed application, embedded live from soc-analyst-pi.vercel.app. If it doesn't load below (some browsers block third-party embeds), open it directly.
Loading live application...
Client-side sandbox. State is in memory and nothing is sent to a server.
Next Case Study