Ragnarok SIEM Triage

A SIEM alert-triage service built with teammates in 24 hours: it scores incoming security alerts, explains every score, and suggests a first response.

Team project at the Black Pearl hackathon. I helped design the triage flow and the security workflow around it; the service code lives in a teammate's repository.

What it does

• Alert scoring
• Score explanations
• Suggested response

A FastAPI service scores each alert from rule severity, threat-intelligence hits, burst counts, asset criticality, MITRE technique risk and suspicious-command patterns, explains the score, and suggests whether to block the source IP or enrich the alert.

Alerts are posted to /score, which combines weighted signals into a priority and a suggested action. /why/{dedup_key} returns the reasons behind any score, and /metrics exposes counters. The team's design places the service between Wazuh alerts and TheHive cases, with MISP for threat intelligence.

• Python
• FastAPI
• SIEM
• MITRE ATT&CK
• Threat intelligence

Themes

• Cybersecurity
• Hackathon
• Explainability

• Producing a score an analyst can trust: every point has to be explainable.
• Scoping a full SOC pipeline down to what could work in 24 hours.

• Built in 24 hours with teammates.
• Won 1st place at the Black Pearl Cybersecurity Hackathon.

• Explainable heuristics beat opaque scores when an analyst makes the final call.
• Security tooling needs clear escalation and review boundaries.