Skip to content
ZK
ZAIN KHALIL KHAN
PORTFOLIO
All projects

Interactive build

SentinelSOC | Security Operations Center Dashboard

Real-time SOC console that ingests alerts, correlates them against MITRE ATT&CK techniques, scores severity, and drives an analyst triage queue with acknowledge/escalate workflows.

Live demo readySIEM + MITRE ATT&CK
SIEMMITRE ATT&CKThreat DetectionReactIncident ResponseCase study / interactive demo

Case study

From problem to working system

Problem

Real-time SOC console that ingests alerts, correlates them against MITRE ATT&CK techniques, scores severity, and drives an analyst triage queue with acknowledge/escalate workflows.

My role

Security engineer and full-stack developer

Solution

Real-time SOC console that ingests alerts, correlates them against MITRE ATT&CK techniques, scores severity, and drives an analyst triage queue with acknowledge/escalate workflows.

Architecture

The implementation combines the following technologies and system concerns.

SIEMMITRE ATT&CKThreat DetectionReactIncident Response

How it was built

  • Built a SOC console that ingests alerts, correlates them against MITRE ATT&CK techniques, and drives an analyst triage queue end to end.
  • Implemented acknowledge, escalate, and close workflows with state that survives handoff between shifts.

Security decisions

  • Surfaced the ATT&CK tactic and technique on every alert so the queue reads as an attack narrative, not a list of strings.

Major challenges

  • Scored severity from technique, asset criticality, and correlation depth rather than trusting the raw severity a source reports.
  • Grouped related alerts into one investigable incident so an analyst works a chain instead of chasing individual events.
  • Surfaced the ATT&CK tactic and technique on every alert so the queue reads as an attack narrative, not a list of strings.

Verified evidence

Results and measurable impact

  • Surfaced the ATT&CK tactic and technique on every alert so the queue reads as an attack narrative, not a list of strings.

Screenshots and access

Product view

Open live project

Interactive Demo

A scoped, fully functional recreation of this project's core feature runs below, live in your browser. Reset it, resize it, or expand it to full screen.

SentinelSOC

Security platform

SentinelSOCWorkspace1 updates
SentinelSOC · Triage Console
LIVE

A live feed of security alerts, correlated against MITRE ATT&CK techniques and ranked by severity. Related signals are grouped into incidents. Click any alert for full context, then acknowledge to clear noise or escalate to the response team.

open

0

critical

0

escalated

0

mtta

--

SeverityStatus

No alerts match the current filters.

Zain Khalil Khan