SOC Platform
Enterprise-grade security monitoring, threat detection, incident response, and security orchestration powered by MITRE ATT&CK framework and AI-driven analytics
SOC Dashboard v2.0
Unified security operations dashboard with real-time threat monitoring, MITRE ATT&CK mapping, Cyber Kill Chain visualization, and incident timeline for comprehensive security situational awareness.
Real-Time Security Metrics (4 KPIs)
Clickable statistics cards providing instant security posture visibility.
- Active Incidents: Critical + High severity count with trend %
- MITRE Techniques Detected: Unique technique count
- Correlated Events: Total correlated events with rate %
- Threats Blocked: Blocked count with block rate %
- Click any metric for detailed drill-down modal
Threat Detection Categories (8 Types)
Comprehensive threat classification with severity indicators.
- Malware Infections: Virus/malware detections (High)
- Intrusion Attempts: IPS blocked attacks (High)
- Web Threats: Malicious web activity (Medium)
- Suspicious Apps: Unauthorized applications (Medium)
- Data Exfiltration: Data leak detection (High)
- Lateral Movement: Internal scanning (Medium)
- C2 Communications: Command & Control traffic (High)
- Privilege Escalation: Elevation attempts (Medium)
MITRE ATT&CK Tactics Grid (14 Tactics)
Full MITRE framework integration with detection mapping.
- Reconnaissance, Resource Development
- Initial Access, Execution, Persistence
- Privilege Escalation, Defense Evasion
- Credential Access, Discovery
- Lateral Movement, Collection
- Command & Control, Exfiltration, Impact
- Detection count per tactic with active indicators
- Click tactic for related events drill-down
Global Threat Intelligence Feed
Real-time threat intelligence integration and IOC database.
- Total IoCs: 150,000+ indicators in database
- Active C2 Servers: 1,400+ known C2 IPs
- Malicious URLs: 5,000+ blocked URLs
- Active Campaigns: 20-50 tracked campaigns
- Automatic update timestamps
- Threat feed correlation with local events
Cyber Kill Chain Analysis (7 Phases)
Interactive kill chain visualization with phase-specific detection counts. Click any phase for detailed event analysis and mapped MITRE tactics.
Charts & Visualizations
- Critical events trend (red line)
- High severity events (orange line)
- Medium severity events (blue line)
- 7 time periods: 6h ago β Now
- Chart.js implementation
- Virus detections (red)
- IPS events (orange)
- WebFilter blocks (blue)
- App Control events (green)
- Interactive legend with color coding
- Color-coded severity badges
- Source/destination IP tracking
- Action status (blocked/allowed)
- Click for full alert details
- Real-time updates
- Correlation percentage display
- Related events linking
- Threat clustering visualization
- Attack chain correlation
Data Exfiltration Analysis Modal
- Summary: Total Events, Data Transferred, Blocked/Allowed
- Top Source IPs with total MB sent and destinations
- Cloud/File Sharing Activity (OneDrive, Dropbox, etc.)
- Large Data Transfers table (>100KB)
- Protocol-Based Transfers (SSH, FTP, SFTP)
- File detection in transfer streams
Primary Use Case
SOC analysts use this dashboard as their primary threat monitoring interface. The MITRE ATT&CK mapping enables standardized threat classification, while the Kill Chain visualization helps track attack progression. The C2 detection feature with SOAR integration enables immediate incident creation and automated response.
MITRE ATT&CK Dashboard
Complete MITRE ATT&CK framework visualization with technique coverage analysis, detection mapping, AI-powered analysis, and actionable remediation recommendations.
ATT&CK Matrix Visualization
Dynamic 14-column matrix with complete technique mapping.
- 14 tactic columns with color-coded headers
- 201 techniques reference (MITRE framework)
- Interactive technique items with hover effects
- Detection count per technique
- Click technique β Detailed modal with remediations
- Horizontal scrolling for full matrix view
Statistics Dashboard (4 KPIs)
Key MITRE coverage and detection metrics.
- Total Detections: MITRE-mapped alert count + trend %
- Unique Techniques: Distinct techniques detected (X of 201)
- Active Tactics: Tactics with detections (X of 14)
- Critical Alerts: Immediate action required count
- Click any card for detailed breakdown
Technique Database (27+ Core)
Comprehensive technique details with threat intelligence.
- T1595: Active Scanning (Reconnaissance)
- T1566: Phishing (Initial Access)
- T1059: Command Interpreter (Execution)
- T1110: Brute Force (Credential Access)
- T1021: Remote Services (Lateral Movement)
- T1071: App Layer Protocol (C2)
- T1486: Data Encrypted for Impact
- + 20 more techniques with full mapping
AI-Powered Analysis
Real-time AI contextual analysis with web search grounding.
- AI technique analysis button per technique
- Context: technique ID, tactic, detection count
- Web search grounding for latest intelligence
- Provider attribution (Claude, GPT)
- Severity highlighting (CRITICAL, HIGH)
- Formatted markdown response with citations
14 MITRE ATT&CK Tactics
Technique Detail Modal Features
- Technique ID and name with tactic association
- Detection count (total + severity breakdown)
- Description and threat context
- Recommended remediations with priority badges
- Data sources for detection
- Recent detections list (filtered)
- AI Analysis button for deep investigation
- Direct link to MITRE ATT&CK website
Primary Use Case
Security architects use this dashboard to assess detection coverage against the MITRE ATT&CK framework. The technique detail modals provide actionable remediations with priority levels, while the AI analysis offers real-time threat intelligence context for emerging techniques.
SOAR Platform
Security Orchestration, Automation, and Response platform with visual playbook builder, automated incident handling, multi-source integrations, and real-time collaboration war rooms.
Visual Playbook Builder
Drag-and-drop workflow designer with 25+ node types.
- Triggers (4): Alert, Schedule, Manual, Webhook
- Response Actions (5): Isolate, Block IP, Kill Process, Quarantine, Disable User
- EDR Actions (10+): Memory Dump, YARA Scan, Force Reboot, Lock Screen, etc.
- Enrichment (4): IOC Lookup, VirusTotal, WHOIS, Collect Artifacts
- Logic (4): Condition, Loop, Delay, Parallel
- Notifications (4): Slack, Teams, Email, Jira
- Mini-map navigation, Zoom controls, Fit View
Incident Management
Complete incident lifecycle tracking and bulk operations.
- Incident table: ID, Title, Severity, Status, Source, Assigned
- Severity: Critical/High/Medium/Low with badges
- Status workflow: Open β Investigating β Resolved β Closed
- Bulk operations: Status update, Assign, Run playbook
- Filter by Category, Status, Severity
- Select All checkbox with count display
- Recent incidents quick panel (last 5)
Active Integrations (12+ Types)
Multi-vendor security tool orchestration.
- Firewalls: FortiGate, Palo Alto, Sophos
- EDR: CrowdStrike, SentinelOne, Defender
- SIEM: Splunk, ELK, Datadog
- Ticketing: Jira, ServiceNow
- Integration stats: Total, Healthy, Read-Write, Actions Today
- Filter by category, Add integration, Test connection
- Import from existing devices (bulk)
Dashboard Metrics (4 KPIs)
Key SOAR performance indicators.
- Active Incidents: Count with trend indicator
- Pending Approvals: Workflow approvals queue
- Automation Rate: % automated vs manual
- Avg MTTR: Mean time to remediation
- Recent Executions panel with status
- Active Playbooks list
SOAR Navigation (22 Sections)
- Dashboard – Main SOC overview
- Incidents – Incident management
- Playbooks – Playbook library
- Playbook Builder – Visual editor
- Executions – Execution tracking
- Approvals – Approval queue
- Actions – Remediation actions log
- IOCs – Indicator database
- Threat Actors – Known actors
- Campaigns – Threat campaigns
- STIX/TAXII Feeds – Feed integration
- SOC Analytics – Performance metrics
- Anomaly Detection – Behavior anomalies
- Alert Triage – AI prioritization
- UEBA – User behavior analytics
- AI Insights – ML recommendations
- War Rooms – Real-time collaboration
- Attack Storyline – Neo4j graph visualization
- Device Mapping – Alert-to-integration routing
- Analyst Workload – Load balancing
- Audit Log – System audit trail
SOC Analytics Dashboard
- MTTR (Mean Time to Respond) with min/max indicators
- Automation Rate % with automated vs manual counts
- SLA Compliance by severity level
- Playbook Success Rate percentage
- Incident Trend Chart (7/14/30/90 days)
- Severity Distribution pie chart
- SLA Compliance table by severity
- Analyst Performance table with efficiency scores
Primary Use Case
SOC teams use SOAR to automate repetitive incident response tasks. When a critical alert triggers, the playbook automatically enriches the alert with VirusTotal data, isolates the affected endpoint via EDR integration, creates a Jira ticket, and notifies the team via Slack – all within seconds.
Threat Hunting Dashboard
Proactive threat hunting workspace with pre-built MITRE-mapped hunts, IOC search capabilities, custom Elasticsearch queries, and evidence collection for security investigations.
Hunt Library (10 Pre-built Hunts)
MITRE ATT&CK mapped threat hunts ready to execute.
- Brute Force (T1110): Multiple failed logins in 5 min
- Password Spray (T1110.003): Same password across accounts
- RDP Lateral (T1021.001): Internal RDP connections
- SMB Lateral (T1021.002): SMB file sharing between hosts
- C2 Beacon (T1071, T1573): Periodic outbound connections
- DNS Tunneling (T1071.004): Long DNS queries
- Large Data Transfer (T1041): Unusual outbound data
- Log Clearing (T1070.001): Security log clearing
- Scheduled Task (T1053): New scheduled tasks
- Phishing (T1566): Blocked phishing attempts
IOC Search Features
Search for Indicators of Compromise across all logs.
- Search by IP address (e.g., 192.168.1.100)
- Search by domain (e.g., malware.com)
- Search by file hash (MD5/SHA1/SHA256)
- Automatic IOC type detection
- Time range filtering: 1h, 24h, 7d, 30d
- Known threat alert when IOC matches database
- Full event context with timestamps
Custom Query Editor
Full Elasticsearch query support for advanced hunting.
- Elasticsearch query syntax support
- Syntax highlighting (Fira Code font)
- Query templates with examples
- Execute immediately or save for later
- Full JSON result display
- Save custom hunts with metadata
Results & Evidence Collection
Comprehensive hunt results with evidence preservation.
- Summary Stats: Total Hits, Unique Sources, Alerts, Time Span
- Timestamp tracking per event
- Source β Destination flow display
- Action indicators (deny/allow badges)
- Full JSON data for custom queries
- Device and hostname identification
- Message field (truncated to 200 chars)
Main Navigation Tabs
- 4-stat summary dashboard
- Color-coded result items
- Severity and action badges
- Click for detailed event view
- Full-featured query editor
- Execute and Save buttons
- Query validation
- Pretty-printed JSON results
- Saved hunt cards
- Hunt name and description
- Category and MITRE tags
- Execute saved hunts
Save Hunt Modal
- Custom hunt name field
- Multi-line description input
- Category selection (8 predefined + Custom)
- MITRE Techniques (comma-separated IDs)
- Persistence to database
- Reusable hunt library
Primary Use Case
Threat hunters use this dashboard to proactively search for indicators of compromise and attacker behavior patterns. The pre-built hunts based on MITRE ATT&CK techniques enable hypothesis-driven hunting, while the custom query editor allows advanced analysts to craft specific detection queries.
UEBA Dashboard
User and Entity Behavior Analytics with ML-powered anomaly detection, risk scoring, baseline modeling, peer group analysis, and insider threat detection.
Dashboard Statistics (6 KPIs)
Key user behavior and risk indicators.
- Active Users: Currently monitored user count
- ML Anomalies: Machine learning detections
- Failed Logins: Authentication failure count
- Impossible Travel: Geographic anomaly count
- Privilege Escalation: Elevation attempt count
- Insider Threat Score: Overall risk level
Anomaly Detection Types (5+)
Multiple behavioral anomaly detection mechanisms.
- Brute Force: 5+ failed logins in 5 minutes
- After-Hours Activity: 10 PM – 6 AM access
- Sensitive Privilege Use: SeDebugPrivilege, etc.
- Impossible Travel: Mumbai β New York in 30 min
- Unusual Login Times: Out-of-pattern hours
- Severity levels: Critical/High/Medium/Low
Risk Scoring System
Weighted risk calculation per entity.
- 0-100 numeric risk scale
- Critical: Score β₯ 80 (red gradient)
- High: Score β₯ 60 (orange gradient)
- Medium: Score β₯ 30 (amber gradient)
- Low: Score < 30 (green gradient)
- Score trends: Increasing/Decreasing/Stable
- 7-day rolling window calculation
Baseline Modeling
Per-user behavioral baseline with peer group analysis.
- Typical login hours (0-23 array)
- Average daily login frequency
- Average privilege use frequency
- File access patterns
- Resource access baselines
- Minimum 10 data points required
Peer Group Analysis (3 Groups)
- Avg Daily Logins: 4.2
- Avg Privilege Uses: 12.5
- Higher baseline for admin activities
- Stricter deviation threshold
- Avg Daily Logins: 2.1
- Avg File Access: 45.3
- High file access baseline
- More lenient threshold
- Avg Daily Logins: 1.5
- Avg Ticket Access: 23.7
- Lower activity baseline
- Tightest deviation threshold
ML Anomaly Detection Model
- Model Accuracy: 94%
- Events Analyzed: 1.2M
- False Positive Rate: 0.3%
- Status: Active and Running
- Login Pattern Analysis module
- Resource Access Profiling module
- Behavior Deviation Scoring module
Charts & Tables
| Visualization | Type | Data Displayed |
|---|---|---|
| Activity Heatmap | ApexCharts Heatmap | 7 days Γ 12 hours, color-coded activity intensity |
| User Risk Scores Table | Ranked Table | User, Risk Factors, Risk Score (color-coded) |
| Recent Anomalies Table | Event Table | Time, User, Anomaly Type, Description, Risk, Severity |
Primary Use Case
Security analysts use UEBA to detect insider threats and compromised accounts. When a user’s behavior deviates significantly from their baseline (e.g., logging in at unusual hours from a new location), the system raises an anomaly alert with risk scoring, enabling proactive investigation before damage occurs.
EDR Dashboard
Endpoint Detection and Response platform with agent monitoring, memory threat detection, LOLBin tracking, ransomware protection, deception technology, and advanced threat hunting capabilities.
Statistics Cards (6 KPIs)
Key endpoint detection metrics.
- Critical Events: Highest severity detections
- High Severity: High priority alerts
- Total Events (24h): All detections today
- Memory Threats: Memory-based attacks
- LOLBin Activity: Living-off-the-land binaries
- Total Endpoints: Managed endpoint count
Memory Threat Detection (4 Types)
Advanced memory-based attack detection.
- Process Injections: Code injection detection
- Shellcode Detection: Shellcode pattern matching
- Process Hollowing: Hollowed process detection
- RWX Regions: Read-Write-Execute memory
- Fleet-wide memory scan capability
- Memory threats list with scrolling
LOLBin Activity Grid (8 Binaries)
Living-off-the-land binary execution tracking.
- certutil: Certificate utility abuse
- mshta: HTML application execution
- regsvr32: COM object registration abuse
- rundll32: DLL execution
- wmic: WMI command execution
- bitsadmin: Background transfer abuse
- cscript: Script host execution
- powershell: PowerShell execution
- Clickable filters for investigation
Ransomware Protection
Advanced ransomware detection and prevention.
- Protected Endpoints counter
- Active Canaries counter (canary files)
- Ransomware Alerts (24h)
- Blocked ransomware attempts
- VSS (Volume Shadow Copy) protection toggle
- Canary file deployment
- ML-based behavior analysis
Deception Technology
Honeypots and honey tokens for threat detection.
- Honeypot servers (FAKE-DC01)
- Honey shares (\\SHARES\Finance)
- Honey credential files (admin_backup.kdbx)
- Honey service accounts (svc_backup)
- Trigger alert counter
- Quick deploy buttons
- Active/Inactive status badges
Threat Hunt Builder
Endpoint-focused threat hunting capabilities.
- Hunt Templates (6): LOLBin, Credential, Persistence, Lateral, C2, Data Staging
- Hunt types: Process, Network, File, Registry, DNS, IOC
- Time range: 1h, 24h, 7d, 30d
- Target scope: All, Servers, Workstations, Critical
- Quick Hunts: Encoded PowerShell, Mimikatz, PsExec, Cobalt Strike
- Hunt results with match counting
Response Actions
Immediate threat response capabilities.
- Isolation: Network isolate (bulk/single)
- Scanning: Full fleet scan, Memory scan
- Collection: Forensics data collection
- Live Response: Command execution
- Export: IOC export functionality
- Prevention mode toggle (Detect vs Block)
MITRE ATT&CK Integration
Technique mapping for endpoint detections.
- T1059.001: PowerShell execution
- T1003.001: LSASS Memory dumping
- T1547.001: Registry persistence
- T1055: Process Injection
- 14 tactics Γ 200+ techniques mapped
- Technique badges in detection table
Detection & Analysis Tables
- Recent Detections: Title, Host, Timestamp, Severity, MITRE technique
- Top Affected Hosts: Ranked 1-10 with event counts
- IOC Panel: Recent IOCs by type (IP, Hash, Domain, URL)
- MITRE Techniques Panel: Technique ID, Tactic mapping
- Hunt Results: Hostname, Detection type, Match count
Primary Use Case
Security teams use the EDR dashboard to monitor endpoint health and detect advanced threats. When a memory injection or LOLBin abuse is detected, analysts can immediately isolate the endpoint, collect forensics, and run targeted hunts across the fleet to identify lateral movement.
Vulnerability Dashboard
CVE tracking and vulnerability management with CVSS scoring, asset-vulnerability mapping, remediation workflows, and patch compliance reporting.
Dashboard Statistics (5 KPIs)
Vulnerability posture metrics.
- Total Vulnerabilities: All CVEs detected
- Critical: CVSS β₯ 9.0 (red badge)
- High: CVSS 7.0-8.9 (orange badge)
- Medium: CVSS 4.0-6.9 (yellow badge)
- Scanned Apps: Applications scanned
CVSS Scoring System
Industry-standard vulnerability severity scoring.
- Critical (8.6-10.0): Red gradient badge
- High (7.0-8.5): Orange gradient badge
- Medium (4.0-6.9): Amber gradient badge
- Low (0.1-3.9): Green gradient badge
- Numeric CVSS scores (0-10 scale)
- Color-coded severity visualization
CVE Tracking
Comprehensive CVE database and tracking.
- CVE ID display (e.g., CVE-2023-38831)
- NVD (National Vulnerability Database) linked
- CVE description with vulnerability details
- Real-world CVEs: WinRAR, PuTTY, Chrome, Adobe
- Affected software ecosystem scope
- Version ranges impacted
Remediation Workflows
Patch management and remediation tracking.
- Update action buttons per vulnerability
- Version path recommendations (e.g., 6.20 β 6.23+)
- Fix version field (minimum patched version)
- Installed version tracking
- Bulk remediation capability
- Patch availability status
Charts & Visualizations
- Critical count (red segment)
- High count (orange segment)
- Medium count (yellow segment)
- Low count (green segment)
- Interactive legend
- ApexCharts implementation
- Software name on Y-axis
- CVE count on X-axis
- 7 applications tracked
- Purple color scheme (#8b5cf6)
- Interactive tooltips
- CVE ID column
- Software name
- Installed version
- Fix version
- CVSS score badge
- Description
- Update action button
Primary Use Case
IT security teams use this dashboard to prioritize patch management efforts. The CVSS scoring helps focus on critical vulnerabilities first, while the remediation workflow tracks patch progress across the software inventory.
Threat Intelligence Dashboard
Threat actor tracking, campaign monitoring, STIX/TAXII feed integration, and IOC management for proactive threat intelligence operations.
IOC Management
Indicator of Compromise database and scoring.
- Add IOC with type classification
- IOC types: IP, Domain, Hash, URL, Email
- Confidence scoring per IOC
- Scoring history tracking
- IOC search across all logs
- Known threat database matching
Threat Actor Tracking
Known threat actor database and profiles.
- Add Threat Actor entries
- Actor profile management
- Associated TTPs (Tactics, Techniques, Procedures)
- Target industries and regions
- Attribution confidence levels
- Actor activity timeline
Campaign Monitoring
Active threat campaign tracking.
- Add Campaign functionality
- Campaign name and description
- Associated threat actors
- Campaign IOCs
- Target victims/industries
- Campaign timeline and status
STIX/TAXII Feed Integration
Automated threat intelligence feed ingestion.
- Total Feeds: Configured feed count
- Active Feeds: Currently polling feeds
- Objects Imported: Total STIX objects
- Refresh Feeds button (force sync)
- Add Feed configuration
- Poll Now (immediate sync)
Primary Use Case
Threat intelligence analysts use this dashboard to manage IOCs, track threat actors, and correlate external threat feeds with internal detections. The STIX/TAXII integration enables automated enrichment of security events with threat intelligence context.
Technical Specifications
Security Frameworks
- MITRE ATT&CK (14 tactics, 200+ techniques)
- Cyber Kill Chain (7 phases)
- STIX/TAXII 2.x support
- CVSS 3.1 scoring
- NIST CSF alignment
Detection Sources
- FortiGate UTM (Virus, IPS, Web, App)
- EDR agents (memory, process, file)
- SIEM/Elasticsearch logs
- Network traffic analysis
- User behavior analytics
AI/ML Capabilities
- Anomaly detection (94% accuracy)
- Behavioral baseline modeling
- AI contextual analysis
- Predictive risk scoring
- False positive reduction (0.3%)
SOAR Integrations
- Firewalls (FortiGate, Palo Alto, Sophos)
- EDR (CrowdStrike, SentinelOne, Defender)
- SIEM (Splunk, ELK, Datadog)
- Ticketing (Jira, ServiceNow)
- Communication (Slack, Teams, Email)
Playbook Automation
- 25+ node types
- Visual drag-and-drop builder
- Conditional logic and loops
- Parallel execution support
- Approval workflows
Threat Hunting
- 10+ pre-built hunts
- Elasticsearch query support
- IOC search (IP, Domain, Hash)
- Custom hunt builder
- Saved hunt library
EDR Capabilities
- Memory threat detection
- LOLBin monitoring (8 binaries)
- Ransomware protection
- Deception technology
- Live response commands
Collaboration
- War rooms (real-time chat)
- Attack storyline (Neo4j graphs)
- Analyst workload balancing
- Incident assignment
- Audit logging