What works today
- Searchable, filterable alert replay
- Evidence-linked triage drafts
- Local analyst decisions and JSON export
- Executable fixture and capability checks
- Responsive, keyboard-accessible interface
SYNTHETIC DATAExplore the workflow safely. Rule-based baseline · No live SIEM or model connection · Decisions stay in this browser.
Less noise. More context.
Inspect the evidence. Challenge the draft. Make the decision.
Alert queue
REPLAY- 06 alerts in replay
- 03 escalation candidates
- 00 analyst decisions
- Read only, no response actions
All timestamps are fictional replay values.
Evaluation lab
Executable checks, visible scope, reproducible results.
These checks validate six development fixtures and a restricted capability model. They do not measure real-world precision, analyst time savings, or model resistance to prompt injection.
Run the suite to inspect each expectation and outcome.
Every decision, in context.
A local review trail with notes and timestamps. Browser storage is editable, not a tamper-proof audit log.
Evidence before action.
A working SOC review interface that makes its reasoning, limits and evaluation inspectable.
01Replay fixturesSynthetic identity, endpoint and network events
→02Structured triageDeterministic rules and cited evidence
→03Analyst reviewExplicit disposition and required notes
→04EvaluationExpected outcomes and boundary checks
What is not claimed
- No live LLM, Wazuh or Splunk integration in this interface
- No production deployment or customer usage
- No measured time savings or held-out accuracy
- No autonomous containment
- No new research contribution established
Next engineering milestone
Connect a server-side model adapter with protected credentials, add authenticated multi-user review, then evaluate on independently labelled, authorized telemetry against this baseline. A separate, non-public homelab deployment has done the model-adapter and telemetry-ingestion parts of this against a real SIEM; independent held-out evaluation is still open. That deployment is not reachable from this interface and is documented with evidence rather than linked live.
Connect a server-side model adapter with protected credentials, add authenticated multi-user review, then evaluate on independently labelled, authorized telemetry against this baseline. A separate, non-public homelab deployment has done the model-adapter and telemetry-ingestion parts of this against a real SIEM; independent held-out evaluation is still open. That deployment is not reachable from this interface and is documented with evidence rather than linked live.