SOC Copilot

AI-assisted SOC incident triage that analyzes attacks, maps MITRE techniques, assesses severity, and recommends response actions.

Comment

SOC Copilot

As a CSE student with a strong interest in cybersecurity and AI, I wanted to build something that connected the two areas I have been spending a lot of time learning about. In cybersecurity, I found myself particularly interested in how security analysts have to turn large amounts of security information into a quick and actionable understanding of what is happening.

That led me to build SOC Copilot, an AI-assisted Security Operations Center (SOC) incident triage application.

The idea

The goal was to create a small but realistic SOC workflow where an analyst could take a security incident, understand its severity, identify the relevant MITRE ATT&CK technique, and get suggested response actions without having to manually work through every part of the initial triage process.

SOC Copilot can:

  • Analyze security incidents and attack scenarios
  • Assign severity and confidence
  • Map incidents to relevant MITRE ATT&CK techniques
  • Generate recommended response and containment actions
  • Provide a dashboard for an overview of incidents
  • Maintain a local incident history
  • Provide realistic simulated attack scenarios for testing and demonstration

How I built it

I built the application using Next.js, TypeScript, React, OpenRouter, and MITRE ATT&CK concepts.

The application follows a simple SOC-style workflow. An analyst selects or submits an incident through the Incident Analyzer. The event is processed by the analysis layer and returned as structured triage information, including severity, confidence, MITRE ATT&CK mapping, and recommended actions.

I also designed the interface around how an analyst would actually interact with the information: first understanding what happened, then determining how serious it is, identifying the attack technique, and finally deciding what response should be taken.

The project is deployed on Vercel and can be tested through the live demo:

Live Demo: https://soc-copilot-sable.vercel.app

What I learned

One of the main things I wanted from this project was practical experience combining AI with a cybersecurity workflow rather than treating AI as a standalone chatbot.

While building it, I learned more about structuring security information into something an AI system can reason about and return in a useful format. I also had to think about how the results should be presented to a security analyst instead of simply displaying a generated text response.

This project also helped me understand an important distinction between building an AI-powered prototype and building a real SOC tool. A useful security application needs structured outputs, explainable reasoning, relevant attack mappings, and actionable recommendations—not just an AI-generated answer.

Challenges

One of the biggest challenges was keeping the project realistic while still making it practical for a hackathon demonstration.

A real SOC platform would normally receive telemetry from sources such as SIEMs, endpoints, and network infrastructure. Connecting to live security infrastructure was outside the scope of this project, so I created simulated attack scenarios and a local incident history instead.

Another challenge was designing the application so that the AI output could fit naturally into a SOC workflow. Instead of making the AI response the entire interface, I structured the application around severity, confidence, MITRE ATT&CK techniques, incident details, and recommended actions.

Why I built it

I built SOC Copilot because I wanted to experiment with something directly related to the area I am most interested in: using AI to make cybersecurity analysis more practical and efficient.

This project is a prototype rather than a replacement for a production SOC or security analyst. The attack events included in the application are simulated scenarios, and the application is not connected to live SIEM or endpoint telemetry.

For me, the most valuable part of the project was taking concepts I have been learning in cybersecurity and AI and turning them into something I could actually build, deploy, and test.

Built With

Share this project:

Updates

Submission history