ClearSOC
An AI-assisted security operations workspace for investigating application security events and deciding what to look at next.
Independent project · Under active design and development
Move from a spike to a decision.
- 01 / Detect
Spot a spike
See that security activity has changed enough to warrant a closer look.
- 02 / Scope
Identify affected applications
Understand where the increase is happening before diving into individual events.
- 03 / Investigate
Inspect the evidence
Explore event data with queries or ask follow-up questions in natural language.
- 04 / Review
Consider next steps
Review suggested actions as decision support; an analyst remains responsible for what happens next.
Example investigation questions
- “Which applications saw the biggest increase in blocked requests?”
- “What changed during the spike?”
A telemetry-to-investigation path
- 01
Ingest
Akamai DataStream telemetry is collected from the configured object-storage feed. The source implementation loads compressed event files for processing.
- 02
Store and query
Processed events are stored in ClickHouse for aggregation and investigation.
- 03
Enrich and investigate
Additional context supports triage. Analysts can explore the data with SQL and use a natural-language assistant to ask follow-up questions. Specific enrichment fields and sources are not listed here.
- 04
Review analysis and briefings
Security-analysis reporting is present in the implementation. The briefing concept is to summarize activity worth attention; this page does not claim a fixed report format or generation schedule.
Designed and built independently.
I’m designing and building ClearSOC as an independent project. Its codebase includes a ClickHouse ingestion and query path, analyst investigation workflows, a natural-language assistant interface, and security-analysis reporting. Feature availability is still in development.
AI-generated recommendations are inputs for analyst review. A confidence indicator is a review cue, not a measured probability of correctness. ClearSOC does not automatically change security controls through this recommendation flow.
Interested in the problem space?
Get in touch to discuss the project and its direction.