AI-native security operations center with governed incident response
Build a comprehensive, interactive AI-native security operations center application called "3B SOC" on Tines 3B. The system must function as an internal MDR-style command center driven by a strict operational loop: Alert, Triage, Investigate, Correlate, Hunt, Decide, Approve, Respond, Verify, and Learn. It should operate on the principle that AI reasons, workflows execute, and humans approve high-impact actions. The application must run entirely in a clearly labeled demo mode utilizing deterministic analysis and simulated connector actions without requiring external credentials. Architecturally, divide the application into two primary steps. The first is a tenant-authenticated SOC Console built with React, TypeScript, and Tailwind on a /soc route that polls platform state without overlapping requests. The second is a SOC Platform API running TypeScript on Bun at /soc-api, utilizing persistent state in an exclusively written named volume and featuring scheduled hourly hunting operations. Design the user interface as an elegant enterprise console that defaults to a light pale lavender-gray theme with a dark-mode toggle, strictly avoiding neon "hacker" aesthetics. Utilize slate typography, compact tables, responsive drawers for deep-dive investigations, and a fixed sidebar with a sticky top header. The underlying core data model must utilize shared, normalized records for all entities—including alerts, assets, identities, indicators, and vulnerabilities—ensuring that an update like a contained host or disabled identity reflects consistently across all views while preserving raw telemetry and MITRE technique mappings. The navigation structure should cover operational overviews, deep analysis, incident response, vulnerability management, inventory tracking, and system configuration. Develop a robust suite of analytical and operational features, starting with an overview dashboard featuring a Sankey-style ingestion funnel and MTTD metrics. The Alert Triage module must assign risk scores, verdicts, and explicit contributing factors, allowing analysts to pivot into Investigations that feature interactive ATT&CK timelines, entity relationship graphs, and blast-radius visualizations. Implement a backend-enforced response governance system where simulated containment actions—such as endpoint isolation or password resets—require distinct approvals based on asset tier and automation level. Additionally, build a multi-provider Threat Intelligence workspace with link analysis, a Global Threat Map, a Proofpoint-style Phishing Triage queue, an SLA-driven Vulnerability Management module, and an AI Analyst tool powered by deterministic intent handling rather than a live LLM. Include a detection engineering interface that can generate grounded KQL, Sigma, and EQL candidate rules. Seed the application with a highly realistic, rolling demo dataset of approximately 5,200 daily events across 22 simulated connectors like CrowdStrike, Okta, and AWS. Populate the environment with an active analyst shift containing ongoing incidents, pending approvals, generated workforce identities, and scheduled hunts. Embed four detailed, multi-stage attack scenarios: a phishing-to-domain compromise, an APT41-style RDP intrusion, an APT31-style credential spraying campaign, and an AI pipeline container escape. The final deliverable must be a fully functional application with no dead buttons, working filters and drill-downs, persistent state, and accurate metrics derived directly from the inspectable records. Provide comprehensive READMEs documenting the architecture, state, and simulated integrations, and leave the finalized application in a draft state until approved for publishing.
What this prompt builds
This workflow is a comprehensive, AI-native Security Operations Center (SOC) demonstration environment that unifies alert triage, investigation, correlation, threat hunting, and incident response into a single command center. It operates on the principle that AI reasons, deterministic workflows execute, and humans approve high-impact actions, all within a strictly governed, auditable framework. The system addresses alert fatigue and tool fragmentation by normalizing telemetry from 22+ simulated security tools, automatically suppressing noise, correlating threats into visual attack chains, and enforcing approval workflows for containment actions.
The problem
Security analysts and SOC teams are overwhelmed by alert fatigue, tool fragmentation, and manual incident response processes. Analysts must manually correlate telemetry from dozens of disparate security tools—EDR, cloud platforms, IAM systems, network monitors—to understand an attack's full scope, often drowning in thousands of daily alerts to find genuine threats. Executing response actions like endpoint isolation or account disablement is either dangerously manual or relies on overly autonomous scripts that risk disrupting business operations without proper governance. This workflow delivers an AI-native SOC command center that unifies the entire security lifecycle—alert triage, investigation, correlation, threat hunting, and response—into a single, auditable platform where AI reasons about threats, deterministic workflows execute containment actions, and humans approve high-impact decisions through a strict governance framework.
Solution and impact
Security teams gain a unified command center that automatically normalizes data from 22+ security tools, suppresses up to 61% of noise, and correlates remaining alerts into visual attack chains and blast-radius maps. The workflow enforces strict, server-side approval queues for containment actions, ensuring AI can propose responses like endpoint isolation or credential resets, but humans must approve before execution—eliminating the risk of accidental automated disruptions. By synthesizing threat intelligence, vulnerability data, and asset context into a single view, analysts receive executive summaries and root-cause analysis instead of raw logs, dramatically reducing investigation time and cognitive load. SOC managers benefit from fully auditable trails, enforced response policies, and clear visibility into tool efficacy and coverage gaps, while the broader organization experiences faster threat containment with fewer false-positive disruptions.