ThreatLens

Security analysts often receive disconnected logs, alerts, and audit events from multiple systems. Turning that raw data into a structured, reviewable incident investigation is time-consuming and often results in inconsistent documentation. I wanted to build a tool that helps analysts spend less time organizing data and more time making informed security decisions

ThreatLens was inspired by the idea of combining modern AI with established incident response practices. Rather than replacing analysts, the goal is to accelerate investigations by transforming raw security events into structured evidence, timelines, MITRE ATT&CK mappings, containment recommendations, and executive-ready reports while keeping human analysts responsible for every decision

What it does

ThreatLens is an AI-assisted incident investigation platform built for security analysts. Users can paste security logs or upload TXT, LOG, JSON, JSONL, and CSV files. The application validates and normalizes the input before sending a bounded investigation request to GPT-5.6 through the OpenAI Responses API

The generated investigation includes severity and confidence assessments, evidence-based findings, chronological timelines, MITRE ATT&CK mappings, indicators of compromise, affected assets and accounts, containment actions, long-term recommendations, and executive PDF reports. A deterministic Guided Demo is also included so anyone can explore the complete workflow without consuming API credits

How we built it

ThreatLens was built with Django 6 and Python 3.13 using a service-oriented architecture that separates event parsing, AI analysis, investigation management, PDF generation, and dashboard functionality. GPT-5.6 and the OpenAI Responses API provide structured security reasoning, while Pydantic validates every AI response before an investigation is saved. The frontend uses server-rendered Django templates with responsive HTML and CSS to provide a clean, accessible user experience

Throughout OpenAI Build Week, I used Codex extensively to accelerate development. Codex helped review the Django architecture, improve code quality, strengthen upload and deployment security, expand automated testing, enhance accessibility, refine the user interface, and optimize the overall development workflow while allowing me to focus on the application's design and security features.

Challenges I ran into

One of the biggest challenges was ensuring that AI-generated investigations were both reliable and safe. Handling malformed responses, provider failures, validation errors, and file upload security required careful engineering to ensure the application remained stable under different conditions.

Another challenge was balancing automation with analyst oversight. Rather than presenting AI output as unquestionable truth, ThreatLens clearly separates observed evidence from AI-assisted conclusions and emphasizes that analysts remain responsible for validating every investigation and response decision.

Accomplishments that I'm proud of

I'm proud that ThreatLens evolved into a complete end-to-end investigation platform instead of just an AI chat interface. It supports secure file uploads, structured investigations, MITRE ATT&CK mapping, executive PDF reporting, responsive dashboards, deterministic demo mode, and production-ready deployment features within a single application

I'm also proud of building the project with a strong emphasis on software engineering quality. The application includes modular services, structured validation, comprehensive documentation, automated testing, security best practices, and a polished user experience that demonstrates how GPT-5.6 can be integrated into real-world cybersecurity workflows

What I learned

This project reinforced that successful AI applications require much more than calling a language model. Careful prompt design, structured outputs, schema validation, error handling, and thoughtful user experience design are all essential for building trustworthy AI-assisted software

I also learned how powerful GPT-5.6 and Codex can be when used together. GPT-5.6 provided high-quality structured security analysis, while Codex significantly accelerated implementation, debugging, refactoring, testing, documentation, and overall software quality throughout the development process

What's next for ThreatLens

The next phase of ThreatLens is to evolve from a single-investigation application into a collaborative incident response platform. Planned features include multi-user authentication, role-based access control, case collaboration, evidence management, investigation history, SIEM integrations, cloud log ingestion, threat intelligence enrichment, and support for additional security data sources

Longer term, I plan to deploy ThreatLens as a scalable SaaS platform for security teams. Future enhancements include Retrieval-Augmented Generation (RAG), automated IOC enrichment, timeline visualization, attack graph generation, collaborative workflows, and support for enterprise identity providers, allowing organizations to investigate incidents more efficiently while maintaining human oversight and accountability

Built With

• django
• python