IRIS-SOC Reporting Platform

It automates cybersecurity reporting. It instantly analyzes chaotic incident data, vulnerability analysis data, threat logs, etc., and generates professional, audit-ready reports in a short time.

Comment

Inspiration

Every day, cybersecurity analysts face a massive bottleneck: the blank page. When an attack happens, logs flood in, and evidence scatters across a dozen tools. Before anything can be escalated or acted upon, a highly skilled security professional has to spend 2–4 hours manually formatting a document. For smaller organizations, NGOs, and under-resourced security teams especially across Africa this isn't just an administrative annoyance, it’s a dangerous gap in response time that attackers exploit. We built IRIS-SOC because professional reporting shouldn't be a privilege reserved for massive enterprise teams. We wanted to turn raw chaos into actionable, standardized intelligence in seconds, allowing analysts to get back to what they do best: hunting threats.

What it does

IRIS-SOC Reporting Platform is an AI-powered platform purpose-built for Security Operations Centers (SOCs). An analyst simply pastes in their raw, messy findings server logs, investigation notes, script outputs, or threat data. IRIS-SOC automatically understands the context, classifies the report type, and generates a polished, professional security report in under 60 seconds. It ships with five templates aligned to international standards (like NIST SP800-61, STIX 2.1, and OWASP) and seamlessly exports to Google Docs, PDF, or Word.

How we built it

We designed IRIS-SOC with a modern, enterprise-grade stack:

  1. Frontend: Built a fast, responsive, and clean chat-like interface using React (Vite).
  2. Backend: Powered by Python and FastAPI to handle fast, production-ready API requests.
  3. AI Engine: Integrated Google Gemini 2.5 Pro (via Vertex AI) for its state-of-the-art structured output capabilities and low hallucination rate.
  4. Document Generation: Leveraged the Google Docs API to automatically generate and format the reports in real-time.
  5. Storage & Security: Used AWS S3 to host secure, time-limited download links (auto-expiring after 7 days) and ensured all data is handled with strict NDPA/GDPR compliance and AES-256 encryption.

Challenges we ran into

Our biggest hurdle was ensuring technical precision. Most AI generators summarize or paraphrase text, which is catastrophic in cybersecurity. If an AI alters a CVE number, an IP address, or a file hash, the report becomes useless or worse, misleading. We had to rigorously prompt-engineer and structure our Gemini API calls to ensure it acted as a strict parser rather than a creative writer. We trained the system to preserve technical indicators exactly as entered and to gracefully output "Not provided" when data was missing, prioritizing integrity over the appearance of a "complete" document. Handling the massive variance in unstructured log formats was also a significant parsing challenge that required extensive iterative testing.

What we learned

We learned a massive amount about forcing Large Language Models into strict, predictable schemas. We also gained a deep appreciation for international cybersecurity frameworks (like STIX 2.1 and FIRST TLP 2.0) and how vital standardizing threat intelligence is for the global security community. On the infrastructure side, we leveled up our skills in securely managing ephemeral file storage and real-time document generation via APIs.

What's next for IRIS-SOC

We are starting with reporting, but our vision is much larger. The immediate roadmap includes:

  1. Automated playbook generation based on the incident type.
  2. Multi-analyst collaboration features for complex, multi-day incidents.
  3. Direct API integrations with major SIEM platforms (like Splunk or Microsoft Sentinel) to pull logs automatically without manual copy-pasting.

Built With

Share this project:

Updates