ThreatLedger

AI-powered network threat detection for security teams that can't afford enterprise tools

Comment

Inspiration

Small and medium businesses face the same network threats as Fortune 500 companies — ransomware, lateral movement, command-and-control beacons, data exfiltration. But enterprise NDR tools like Darktrace cost $100,000+ per year, putting them completely out of reach for most organizations. We wanted to build something that brings real threat detection capability to every security team, regardless of budget.

What it does

ThreatLedger is a cloud-native Network Detection and Response (NDR) dashboard that turns raw network security logs into actionable threat intelligence in seconds.

  • Upload Suricata eve.json, Zeek conn.log, Firewall CSV, or AWS VPC Flow Logs
  • Parse — ThreatLedger automatically detects the log format and extracts alerts
  • Correlate — our correlation engine groups raw alerts into meaningful attack campaigns using percentile-based composite scoring
  • Visualize — kill chain mapping shows exactly how far an attacker has progressed (Recon → Exploit → C2 Beacon → Exfiltration)
  • Explain — ChatGPT API generates plain-English threat summaries any analyst can understand
  • Enrich — every source IP is cross-referenced against 21,742 records from Emerging Threats and Blocklist.de feeds

How we built it

Frontend: Next.js 16 App Router on Vercel, scaffolded with Vercel v0, styled with Tailwind CSS and shadcn/ui

Database: Amazon Aurora PostgreSQL on AWS (us-east-1) with pgvector 0.8.1 enabled. We use Prisma ORM for type-safe database access. Aurora stores 5 tables: User, Session, Alert, CorrelationGroup, and IpReputation.

Authentication: Clerk with JWT sessions and Google SSO support

AI: ChatGPT API (claude-sonnet-4-6) for threat group analysis and plain-English summaries

Log parsers: Custom parsers for Suricata eve.json, Zeek conn.log, generic Firewall CSV, and AWS VPC Flow Logs

Correlation engine: Percentile-based scoring that computes composite risk scores across severity, alert count, and pattern danger — automatically grouping alerts into attack campaigns

IP Threat Intelligence: 21,742 IP reputation records seeded from Emerging Threats, Blocklist.de, and WRCCDC feeds

Challenges we ran into

  • Prisma + Aurora on Vercel: Getting Prisma 7 to work with Aurora PostgreSQL on Vercel required configuring the PrismaPg adapter with a connection pool and handling SSL certificate verification correctly in a serverless environment.

  • Multi-format log parsing: Every log format has different field names, separators, and timestamp formats. Building robust parsers that handle real-world variations in Zeek's \x09 separator and VPC Flow Log custom headers took significant iteration.

  • Correlation at scale: Grouping 200,000+ alerts into meaningful campaigns in real time required careful query optimization and batch processing in chunks of 500 to avoid Aurora connection timeouts.

  • Session context persistence: Maintaining the active session context across Next.js server components and client-side navigation without hydration mismatches required moving localStorage access into useEffect hooks.

Accomplishments that we're proud of

  • Parsing and correlating 1,284,019 real Zeek alerts in a single session
  • 21,742 IP reputation records cross-referenced in real time against every alert
  • A correlation engine that reduces hundreds of raw alerts into a handful of actionable threat groups
  • AI summaries that explain complex attack patterns in plain English — no security expertise required
  • Full production deployment on Vercel with Aurora PostgreSQL as the data backbone

What we learned

  • Aurora PostgreSQL with Prisma is a powerful combination for production applications — the type safety from Prisma caught numerous bugs during development
  • pgvector opens up exciting possibilities for semantic similarity search across alert signatures — we enabled it on our Aurora instance as the foundation for future ML-powered detection
  • Vercel's serverless architecture requires careful thought around database connection pooling — PrismaClient needs to be initialized once per process, not per request
  • Building for real security data means handling edge cases that synthetic data never surfaces

What's next for ThreatLedger

  • Semantic search — use pgvector to find semantically similar alerts across sessions, even when exact signatures don't match
  • MITRE ATT&CK mapping — automatically map alerts to ATT&CK techniques using vector embeddings
  • Real-time ingestion — stream logs directly from Suricata/Zeek instead of file uploads
  • Team collaboration — multiple analysts sharing sessions and annotations
  • Custom detection rules — let analysts define their own correlation patterns
  • Zeek full suite — extend beyond conn.log to dns.log, http.log, ssl.log for deeper visibility

Built With

Share this project:

Updates