AI Attack-Story Timeline
An AI-assisted feature for a security platform that correlates a flood of detections into one analyst-readable timeline of what an attacker did, and in what order.
The problem
Analyst time is the scarcest resource in a security operations centre. A single intrusion surfaces as dozens of individually unremarkable detections spread across hosts, identities and time. Reconstructing the story by hand — what happened, in what order, and whether it matters — takes an experienced analyst 30 to 60 minutes per incident, and it is the same reconstruction work every time.
What I built
I work across the pipeline behind an AI-generated "attack story": correlated detections and alerts in, a narrative timeline out, with each step traceable back to the evidence that produced it.
That spans:
- Retrieval over security telemetry — connector ingestion through chunking, embeddings and vector search, so the generation step is grounded in the customer's own data rather than the model's assumptions.
- LLM orchestration for the summarisation and sequencing layer, with structured output so the UI renders a timeline instead of parsing prose.
- Agent tooling over MCP, exposing internal systems to agents as typed tools so a run can gather what it needs without bespoke glue per source.
- The analyst-facing surface in TypeScript and React, where the output has to be skimmable in seconds and auditable when it is questioned.
- Reliability and evaluation — prompt and role design, regression gates on agent behaviour, observability across each step, and cost control.
Why the boring parts mattered most
A generated timeline is only useful if an analyst trusts it, and trust is destroyed by a single confident fabrication. Most of the engineering effort went into constraints rather than generation: grounding every claim in retrieved evidence, failing loudly instead of guessing, recovering cleanly when a long-running job dies partway, and catching behavioural regressions before they reach anyone.
The platform runs in a security-first, data-sovereign environment — isolated execution, least-privilege access, and no customer data leaving its boundary — which shapes every design decision upstream of it.
This case study describes capabilities and my role only. Internal architecture, product naming and customer specifics are deliberately omitted.