ThreatIQ

AI-powered cybersecurity alert investigation and triage, combining Nebius AI inference and NVIDIA embeddings to deliver contextual threat intelligence and analyst-ready insights.

Comment

Inspiration

Security teams receive alerts from multiple tools, but an alert is only the beginning of an investigation. Analysts often need to switch between dashboards, threat-intelligence sources, logs, and security platforms to understand whether an alert is significant and what action to take.

I built ThreatIQ to reduce this investigation burden. My vision is simple: make security investigations more contextual, consistent, and accountable by combining AI-powered analysis with human decision-making.

What it does

ThreatIQ is a multi-tenant cybersecurity alert investigation and triage platform.

  • Alert ingestion: Receives security alerts through authenticated APIs and SIEM integrations.
  • Threat intelligence enrichment: Adds context using sources such as CISA KEV, NIST NVD, and VirusTotal.
  • AI-powered investigation: Uses Nebius-hosted AI inference to generate structured alert assessments and investigation insights.
  • Semantic intelligence: Uses NVIDIA embedding technology to support contextual analysis and similarity-based retrieval.
  • Analyst-focused triage: Presents findings, supporting context, and recommendations so analysts can make informed decisions.
  • Accountability: Maintains investigation records and traceable actions across organizations.

ThreatIQ supports security analysts; it does not autonomously close alerts or execute security responses.

How I built it

I built ThreatIQ using a modular architecture:

  • Frontend: React, Vite, and TypeScript for the analyst dashboard.
  • Backend: Python and FastAPI for APIs, alert processing, integrations, and investigation workflows.
  • Database: PostgreSQL for persistent application data, with SQLite for local development.
  • AI inference: Nebius Token Factory for hosted language-model inference.
  • Embeddings: NVIDIA embedding models for semantic representations.
  • Threat intelligence: CISA KEV, NIST NVD, and VirusTotal integrations.
  • Security integrations: Wazuh and Elastic.
  • Infrastructure: Docker-based development and deployment, with optional AWS services for supporting infrastructure.

I designed the platform around multi-tenancy, authenticated access, structured investigations, and human oversight.

Challenges I ran into

  • Integrating multiple threat-intelligence sources while handling differences in their response formats and availability.
  • Designing a reliable investigation workflow for alerts that may require several enrichment steps.
  • Managing AI inference latency and structuring model responses into predictable, useful assessments.
  • Maintaining tenant isolation and secure access across organizations.
  • Configuring frontend and backend deployments, environment variables, database connectivity, and production settings.
  • Balancing useful AI-generated insights with transparency and analyst control.

Accomplishments I'm proud of

  • Building an end-to-end alert investigation and triage workflow rather than just an AI chatbot.
  • Bringing threat-intelligence enrichment and AI-generated assessments into one analyst-focused platform.
  • Integrating Nebius-hosted inference and NVIDIA embedding technology.
  • Designing the platform for multiple organizations with security and accountability in mind.
  • Developing integrations with established security and threat-intelligence ecosystems.
  • Taking the project beyond a local prototype toward a deployable web application.

What I learned

I learned that cybersecurity AI is not simply about generating answers. It must work with reliable evidence, structured data, secure integrations, and workflows that analysts can understand and verify.

I also gained practical experience with hosted AI inference, embeddings, API integration, multi-tenant architecture, backend deployment, and connecting frontend applications to production services.

Most importantly, I learned that AI should support security professionals rather than replace their judgment.

What's next for ThreatIQ

  • Complete and verify production deployment of the frontend and backend.
  • Expand SIEM integrations and support additional alert formats.
  • Improve investigation quality through evaluation datasets and analyst feedback.
  • Strengthen semantic search and contextual retrieval using NVIDIA embeddings.
  • Improve investigation speed, reliability, and observability.
  • Add richer audit trails, reporting, and organization-level analytics.
  • Expand testing across real-world security workflows.

My goal: Build a reliable AI-assisted investigation platform where every alert has context, every recommendation has supporting evidence, and every final decision remains with the analyst.

Built With

Share this project:

Updates

Submission history