ThreatLens — AI Security Copilot

AI security copilot for startups. ThreatLens monitors your logs, explains threats in plain English, and lets you mitigate incidents in one click — no SOC analyst required.

Comment

Inspiration

Early-stage startups almost never have a security team. A dedicated SOC analyst costs $150k+/year, and enterprise SIEM tools are priced for companies that already have funding rounds behind them — yet a single unmitigated breach can end a startup before it ships its first feature. We wanted to build the security analyst that pre-seed and seed-stage founders can't otherwise afford: something that watches infrastructure 24/7, explains what's happening in plain English, and lets a non-security-expert actually act on it.

What it does

ThreatLens is a conversational AI security copilot. It ingests security logs, lets you query them in natural language ("show me all critical ransomware threats," "are there any suspicious off-hour logins?"), and gives you:

Plain-English threat explanations instead of raw telemetry 1-click incident mitigation — block malicious IPs or isolate infected hosts directly from the UI MITRE ATT&CK mapping so every detected threat is tagged with the standard tactic/technique (e.g. T1486 Data Encrypted for Impact) Real-time Slack alerts for high/critical severity events SOC2-ready CSV audit exports of every action the agent took, for compliance evidence

How we built it

The core is an agentic loop: a Gemini model with function-calling access to four tools —query_logs, semantic_search, get_ip_reputation, and suggest_remediation. When a user asks a question, the agent decides which tool(s) to call, pulls structured or semantic results from MongoDB Atlas (including a vector search index over embedded log data), and turns the result into an actionable, human-readable answer.

Stack:

Frontend: React 18 + TypeScript + Vite, styled with a custom "glassmorphic cyber SOC" design system Backend: Node.js/Express, deployed on Cloud Run Database: MongoDB Atlas with Vector Search for semantic similarity over log embeddings LLM: Gemini for both the conversational agent and log embeddings, with support for bringing your own API key

Challenges we ran into

Getting the Gemini agent to reliably pick the right tool from query_logs, semantic_search, get_ip_reputation, and suggest_remediation was harder than expected — a vague question like "anything weird going on?" could plausibly map to two or three different tools, and early on the agent would sometimes call the wrong one or chain them inefficiently. We had to iterate on the tool descriptions and system prompt to get consistent, low-latency routing.

Setting up MongoDB Atlas Vector Search for the log embeddings took some trial and error — tuning the index configuration and embedding strategy so that semantic queries (like "suspicious off-hour logins") actually surfaced relevant logs instead of loosely related noise.

We also had to think carefully about the tiered entitlement system: gating features like 1-click mitigation, Slack alerts, and CSV export cleanly across three pricing tiers without scattering conditional logic everywhere, while still wiring it up to real Stripe checkout sessions rather than mocking billing.

Accomplishments that we're proud of

A genuinely functional agent loop — not a scripted demo, but a system that dynamically decides which tools to call based on real user questions Getting Gemini's function calling to work smoothly with MongoDB Atlas Vector Search for semantic log retrieval Shipping a full billing and entitlements flow (Stripe checkout, tier gating, evidence export) in the hackathon window, not just a UI mockup Designing a UI that makes security telemetry approachable for founders who aren't security experts — a MITRE ATT&CK tag next to a plain-English explanation, not a wall of raw logs

What we learned

Building an agentic tool-calling system taught us how much prompt and tool-description quality matters for reliability — small wording changes in a tool's description noticeably changed how often the agent picked it correctly. We also learned a lot about vector search tuning in MongoDB Atlas, and about the tradeoffs in designing tiered SaaS pricing so upgrades feel like real unlocks rather than arbitrary restrictions.

What's next for ThreatLens — AI Security Copilot

Automated playbook execution — moving from suggested remediation steps to actually running them (with approval gates) for the top tier Broader log source integrations — ingesting from more providers beyond our current schema (e.g. AWS CloudTrail, GCP Audit Logs, Cloudflare) Security Architect mode — a deeper, proactive review agent that audits infrastructure posture rather than just reacting to logged events Team collaboration features — shared threat triage, assignment, and comment threads for teams beyond a single founder

Built With

Share this project:

Updates

Submission history