Latest posts
-
Authentication Is More Than Login
Authentication Is More Than Login Over the past development phase, one important lesson became clear: Authentication is not just about allowing users to log in. For an AI-powered Security Operations Center, authentication becomes the foundation of every future component. Instead of embedding authentication directly into the application, I redesigned the platform into independent layers. Current…
-
Mapping Security Events to MITRE ATT&CK
➡️ Mapping Security Events to MITRE ATT&CKRaw security events provide data.MITRE ATT&CK provides context.Within the AI-SOC platform, detected activities are automatically mapped to relevant ATT&CK techniques to help analysts understand attacker behavior faster. Examples include:• Failed Logons• PowerShell Abuse• Credential Access Attempts• Discovery Activities• Persistence TechniquesThis mapping helps transform isolated alerts into attack narratives.Instead of…
-
Building an AI Triage Layer for Security Operations
➡️ Building an AI Triage Layer for Security Operations One of the biggest challenges in modern SOC environments is alert fatigue. Security teams often spend significant time reviewing alerts that may not require immediate action. To address this challenge, I built an AI-powered triage layer into the AI-SOC platform. For every incident, the system now…
-
Turning Security Events into Actionable Incidents
One of the key objectives of this project has been moving beyond simple event collection and building a workflow that helps analysts focus on what matters most. Today, security events collected from endpoints are automatically transformed into structured incidents enriched with contextual information that supports investigation and response activities. Instead of reviewing raw logs, analysts…
-
The Most Valuable Part Wasn’t the Code
The most valuable part of building my AI-SOC platform wasn’t Elasticsearch. It wasn’t FastAPI. It wasn’t even the detection engine. It was troubleshooting. During development, I encountered: • Infrastructure instability • VPS migration challenges (very bad experience with Hetzner provider for VPS) • Authentication failures • Elasticsearch index mismatches • Event parsing issues • Database…
-
The Vision Behind AI-SOC with Human review
Building security tools is relatively easy. Building a platform that can detect, investigate, enrich, and explain security incidents is much harder. Over the past weeks, I started building an AI-SOC platform from the ground up. The objective is not simply to collect logs. The objective is to transform raw security telemetry into actionable intelligence. Current…
-
Building an AI-Powered SOC Platform From Scratch
Over the last phase of development, I transformed the SECOPS Platform from a basic incident dashboard into an AI-enhanced security investigation pipeline capable of ingesting, enriching, correlating, and investigating security incidents automatically. The platform architecture now includes: Elasticsearch ↓ FastAPI Backend ↓ Incident Normalization ↓ MITRE ATT&CK Mapping ↓ Risk Scoring Engine ↓ Incident Correlation…
-
Building an AI-Powered SOC Platform From Scratch
Over the last phase of development, I transformed the SECOPS Platform from a basic incident dashboard into an AI-enhanced security investigation pipeline capable of ingesting, enriching, correlating, and investigating security incidents automatically. The platform architecture now includes: Elasticsearch ↓ FastAPI Backend ↓ Incident Normalization ↓ MITRE ATT&CK Mapping ↓ Risk Scoring Engine ↓ Incident Correlation…
-
Building and debugging a custom AI-driven SOC platform from the ground up using Elasticsearch, FastAPI, Python detection pipelines, and a live investigation dashboard.
I’ve been building and debugging a custom AI-driven SOC platform from the ground up using Elasticsearch, FastAPI, Python detection pipelines, and a live investigation dashboard. This started as a simple SOC dashboard experiment, but quickly evolved into a real security engineering project involving backend architecture, detection engineering, incident processing, API authentication, and live frontend synchronization.…
-
ELK Stack Setup (Windows + Winlogbeat + Kibana)
A complete solution for log management, security monitoring, and real-time analytics 1. Start Elasticsearch Verify: 👉 http://localhost:9200 2. Start Kibana cd C:\kibana-9.3.2\bin .\kibana.bat 3. Fix Kibana Authentication In kibana.yml: elasticsearch.hosts: [“http://localhost:9200”] elasticsearch.username: “kibana_system” elasticsearch.password: “<your-password>” 4. Configure Winlogbeat Edit winlogbeat.yml: winlogbeat.event_logs: – name: Application – name: System – name: Security output.elasticsearch: hosts: [“http://localhost:9200”] username: “elastic”…