PhishSlayer

MSSP Clients Page
Cases Page
Threat Hunt Page
Landing Page
MSSP Workspace page
Dashboard/Mission Control

Inspiration

Security teams and MSSPs deal with the same problem every day: too many alerts, too little time, and not enough analysts to investigate everything manually.

Tier-1 SOC analysts often repeat the same tasks for every alert:

Reading raw logs
Understanding severity
Checking suspicious indicators
Writing investigation summaries
Deciding whether to escalate
Recommending what should happen next

PhishSlayer was inspired by this gap.

For this hackathon, I focused on one core part of the larger PhishSlayer idea: using the Gemini API to turn raw security alerts into clear SOC triage summaries with recommended next steps and human approval for risky actions.

The goal is not to blindly replace analysts. The goal is to help analysts move faster while keeping humans in control of sensitive cybersecurity decisions.

What it does

PhishSlayer Gemini SOC Triage Agent is an AI-powered cybersecurity prototype that analyzes Wazuh-style security alerts using the Gemini API.

The prototype takes a security alert and generates structured SOC triage output, including:

Alert summary
Severity level
Confidence score
Likely attack type
Key evidence
Recommended response action
Whether human approval is required

The workflow is simple:

A Wazuh-style security alert is submitted to the system.
The alert is sent to a Gemini-powered triage endpoint.
Gemini analyzes the alert and returns structured SOC output.
The analyst can quickly understand what happened, why it matters, and what action is recommended.
Risky actions are flagged for human approval instead of being executed blindly.

This makes the prototype useful for small SOC teams and MSSPs that want to reduce alert fatigue without removing analyst control.

How Gemini API was used

The Gemini API is used as the reasoning layer for SOC alert triage.

A sanitized security alert is sent to Gemini through an API endpoint. Gemini then returns a structured analysis that includes:

A plain-language explanation of the alert
Severity classification
Confidence score
Likely attack behavior
Evidence from the alert
Recommended response
Human approval requirement

Gemini is not used as a general chatbot in this project. It is used inside a cybersecurity workflow to convert raw alert data into analyst-ready triage output.

The key safety idea is that Gemini can recommend an action, but risky actions such as blocking an IP, isolating a host, or disabling an account should require analyst approval.

How we built it

The prototype was built using:

Next.js
TypeScript
Tailwind CSS
Gemini API
Google AI Studio
Wazuh-style sample alerts
Cybersecurity triage logic

I added a Gemini-powered triage endpoint that receives alert data, sends it to Gemini, and returns structured SOC analysis.

The project also builds on the broader PhishSlayer direction: an AI-assisted SOC platform for MSSPs with case management, evidence handling, audit logs, and analyst approval workflows.

Challenges we ran into

The biggest challenge was reducing a large cybersecurity platform idea into a working hackathon prototype.

PhishSlayer as a full product includes many parts:

Dashboards
Authentication
Workspaces
Cases
Evidence
Reports
Alert ingestion
AI agents
Audit logs

For this hackathon, I narrowed the scope to one important workflow: Gemini-powered alert triage.

Another challenge was designing AI usage safely. In cybersecurity, AI should not blindly execute dangerous actions. A useful SOC assistant needs evidence, confidence, clear recommendations, and approval boundaries.

That is why this prototype separates AI recommendation from final response execution.

What we learned

I learned that Gemini can be used for more than simple chat interactions. It can act as a structured reasoning layer inside a real security workflow.

I also learned that AI in cybersecurity needs to be designed around trust. A good AI SOC assistant should answer:

What happened?
Why is it suspicious?
What evidence supports the decision?
How confident is the model?
What should the analyst do next?
Does this action require human approval?

This changed the focus from “AI that responds automatically” to “AI that helps analysts make faster and safer decisions.”

Accomplishments

I am proud that the project demonstrates a practical Gemini-powered cybersecurity workflow.

The current prototype includes:

Wazuh-style alert input
Gemini API integration
AI-generated SOC triage summary
Severity and confidence output
Recommended response action
Human approval flag for risky decisions
Clear positioning for MSSPs and SOC teams
A roadmap toward full live alert ingestion and AI-assisted investigation

What’s next

The next step is to connect this Gemini triage flow into the full PhishSlayer dashboard.

Future improvements include:

Live Wazuh alert ingestion
Automatic case creation
IP/domain/hash enrichment
MITRE ATT&CK mapping
Analyst approval workflow
Audit logs
PDF incident reports
MSSP client dashboards
Feedback loop from analyst decisions
Pilot testing with a real SOC or MSSP

Long term, PhishSlayer aims to become an AI SOC co-pilot for MSSPs and small security teams that need enterprise-grade triage support without enterprise-level complexity.