SOCLite

Paste raw server logs, phishing emails, or network alerts. SOCLite delivers AI-powered threat analysis and a specific, actionable mitigation playbook in seconds, no security expertise required.

Comment

Inspiration

Inspiration

Every 39 seconds, a small business gets hit by a cyberattack. Most SMEs have no security team, no SIEM tool, and no way to interpret the alerts their systems generate. When a server log lights up at 2 AM, the typical response is panic or silence - both equally dangerous.

I wanted to give a small business owner the same first-response capability as a trained Tier-1 SOC analyst. Without requiring them to be one.

What It Does

SOCLite is an autonomous Tier-1 SOC analyst built entirely on MeDo. Paste raw security data - server logs, phishing emails, network alerts - and SOCLite instantly:

  • Identifies threat indicators: IPs, ports, domains, and attack patterns
  • Scores severity from 0–100 with CRITICAL, MEDIUM, or LOW classification
  • Detects log tampering - flags impossible conditions like private IPs claiming foreign geolocations
  • Generates a prioritized mitigation playbook with specific, numbered, actionable steps
  • Exports a timestamped incident report for insurance claims or security providers

No configuration. No onboarding. No expertise required.

How I Built It

Built entirely through natural language prompts on MeDo, zero manual coding. The approach was architecture-first:

  1. PRD - problem, persona, user journey, and hard constraints before any UI was generated
  2. Data Model - ThreatSubmission, ThreatIndicator, MitigationAction, PlaybookReport
  3. **Design System - cybersecurity-grade palette, monospace typography, severity colors, strict UX rules
  4. Phased Build - layout → logic → playbook → polish
  5. AI Integration - Claude API via Supabase Edge Functions for secure server-side threat analysis

The result: a production-grade React + TypeScript app with Supabase backend and AI-powered threat intelligence built without writing a single line of code.

Challenges

Severity accuracy - early pattern matching scored a complete RCE kill chain (wget + chmod + execute) as MEDIUM. Fixing this required moving to genuine AI reasoning with strict scoring overrides enforced in the system prompt.

Secure API keys - an AI key exposed in a React frontend is a critical vulnerability. Solved with a Supabase Edge Function as a server-side proxy, the key never touches the client.

Accomplishments

  • AI correctly scores complete RCE kill chains CRITICAL 100/100
  • Log tampering detection, absent from most enterprise tools
  • Tested across 9 attack scenarios: SSH brute force, SQL injection, phishing, ransomware, reverse shell, credential stuffing, DNS exfiltration, ARP spoofing, insider threat
  • Production-grade security architecture with zero code written

What I Learned

The ceiling for no-code platforms is much higher than most people assume, if you approach the build with engineering discipline. A PRD and design system before touching the builder is the difference between a polished product and a prototype.

Prompt architecture is engineering. The difference between a tool that misclassifies a live RCE attack and one that scores it CRITICAL 100/100 is entirely in how you structure the AI's instructions.

What's Next

  • Batch log file analysis
  • Threat history and pattern tracking
  • MITRE ATT&CK technique mapping
  • Webhook alerts to Slack or email

Built With

  • claude-api
  • medo
  • react
  • react-router
  • supabase
  • supabase-edge-functions
  • tailwind-css
  • typescript
Share this project:

Updates

Submission history