Impact
Built timeline-driven analysis from fragmented security events.
Impact
Prioritized alerts by evidence density and blast-radius signals.
Impact
Documented clear escalation paths and containment recommendations.
Deliverables
- Incident timeline
- Correlation rules
- Responder summary
Technical Overview
Individual alerts rarely explain an incident by themselves. The project needed a method for joining identity events, endpoint telemetry, DNS, proxy logs, and ticket context into a defensible sequence of activity.
Architecture
flowchart LR
identity_logs[Identity logs] --> normalized_events[Normalize]
endpoint_alerts[Endpoint alerts] --> normalized_events
network_logs[DNS and proxy logs] --> normalized_events
normalized_events --> correlation_rules[Correlation rules]
correlation_rules --> incident_timeline[Incident timeline]
incident_timeline --> response_decision[Containment decision]
Model
where C(h) is host compromise confidence and c_e is the confidence contribution of each event on host h.
Implementation Sketch
index=security earliest=-24h
| eval entity=coalesce(host, user, src_ip)
| stats values(alert) as alerts, min(_time) as first_seen, max(_time) as last_seen by entity
| where mvcount(alerts) >= 3
| sort first_seenEngineering Approach
- Normalize event time, host identifiers, users, source IPs, and alert names into a shared schema.
- Join weak signals into higher-confidence incident hypotheses.
- Record both confirmed and unconfirmed assumptions so responders can act without losing uncertainty.
Results
- Turned alert clusters into concise incident narratives that identify scope, likely entry point, and next action.
- Separated duplicate telemetry from meaningful progression such as initial access, discovery, lateral movement, and exfiltration risk.
- Improved handoff quality by using evidence tables and timestamped assumptions.
What This Demonstrates
- Security operations work improves when analysis is structured around timelines, not alert volume.
- Correlation rules need confidence labels because not every joined signal is causal.
- Responder-ready writing is part of the technical deliverable.