Sangamesh.Dandin
Résumé
All projects

Case 09 / 09SOC automationIn progress

TRIAGEAI.

LLM-assisted SOC alert triage with MITRE ATT&CK mapping.

A triage assistant for security analysts. It ingests SIEM alerts, groups near-duplicates with FAISS vector search, maps each one to MITRE ATT&CK techniques and has Groq's llama-3.3-70b score and prioritise them. Results appear in a React, Vite and FastAPI dashboard. Still in development.

Problem
Noisy SOC alerts
Built with
React, FastAPI, FAISS
Result
Prioritised triage queue
Links
Code not public yet
  • LLM
  • FAISS
  • MITRE ATT&CK
  • Groq
  • React
  • FastAPI

01Overview

At a glance.

09 / 09 · SOC AUTOMATION TriageAI 01Ingest02Deduplicate03Map04Score PIPELINE · 4 STAGES

02Under the hood

How it works.

  1. 01

    Ingest

    Pull in SIEM alerts

  2. 02

    Deduplicate

    FAISS vector search groups near-duplicate alerts

  3. 03

    Map

    Map alerts to MITRE ATT&CK techniques

  4. 04

    Score

    Groq llama-3.3-70b scores and prioritises

→Up next · 01 / 09

Next project.

ZeroInject Shield — Multi-LLM screening for prompt injection in a chat app.

Back to all projects