Skip to content

AlertSage

A SOC-style incident triage console that classifies free-text security alerts, maps them to MITRE ATT&CK, and routes them through your LLM of choice. Open-source, dark-mode-first, modeled on production SIEM consoles.

  • SOC console

    Six-page Streamlit application: Overview, Investigate, Hunt, Batch, Bookmarks, Settings.

    UI guide

  • CLI

    nlp-triage for headless and scripted classification.

    CLI reference

  • Quick start

    Install, launch the console, run your first triage.

    Getting started

  • LLM providers

    Bring Your Own Key for OpenAI, Anthropic, Hugging Face, or run locally.

    LLM integration

What's new in v3.1.0

A complete rewrite of the Streamlit UI, modeled on Splunk Enterprise Security and Elastic Security. Dark theme, severity as the primary color signal, JetBrains Mono for IDs and timestamps, all styling consolidated into one external stylesheet.

Capability Status
SOC-style six-page console New
MITRE ATT&CK kill chain visualization on Investigate New
Auto-extracting IOC panel with VirusTotal enrichment + external pivots New
Case status workflow (New / Triaging / Contained / Closed) New
Case timeline that stitches creation, status changes, notes, bookmarks New
MITRE ATT&CK heatmap on Overview New
Brushable Splunk-style timechart with range selectors New
Auto-refreshing live data panels New
Saved searches pinned to the sidebar New
MITRE coverage report + three CSV exports from Batch New
Anomaly score column on Hunt and Overview New
Demo data generator (synthetic events on a 6 second timer) New
BYOK panels for OpenAI, Anthropic, Hugging Face, VirusTotal New
Local (GGUF) provider hidden when prerequisites are missing New
Per-provider sliding-window rate limiter New

The classifier, MITRE mapping, and database stack are unchanged. The CLI (nlp-triage) is unchanged.

Full notes: release notes.

At a glance

Educational and research software

AlertSage is built on a synthetic incident corpus and is intended for education, research, demos, and portfolio work. It is not a substitute for production security tooling, real threat intel feeds, or analyst judgment. Treat its output the way you would treat a junior analyst's first pass: a useful starting point that needs human review.

The console takes a security analyst's most boring fifteen minutes (read the alert, decide a label, map to ATT&CK, write the rationale, paste actions into the ticket) and turns it into thirty seconds. It ships as a Streamlit-based SOC console plus a CLI; both run on the same TF-IDF + sentence-transformer + Logistic Regression pipeline, with an optional LLM second opinion routed through the provider you configure.

SOC console pages

Page Purpose
Overview Mission control dashboard. Auto-refreshing KPIs, charts, MITRE heatmap, live tail, threat feed, recent events table.
Investigate Triage one incident end-to-end with kill chain, IOC enrichment, case timeline, classification probabilities, LLM rationale, playbook hint.
Hunt Search past triage results with full filter set + saved searches pinned to the sidebar.
Batch CSV ingest with MITRE coverage report and three CSV exports.
Bookmarks Saved investigations with case status workflow and timeline.
Settings Provider configuration, BYOK, demo generator, triage defaults.

Detailed walkthrough: SOC console guide.

Architecture

graph TB
    A[app.py: Streamlit router + 6 pages] --> B[src/triage/]
    A --> C[(data/triage.db)]
    A --> D[assets/styles.css]
    B --> E[classifier: TF-IDF 5000 dims + embeddings 384 dims]
    B --> F[llm_client: HF / OpenAI / Anthropic / Local]
    B --> G[database: SQLite ORM]
    B --> H[llm_helpers: MITRE map, playbook hints, dispatcher]
    F --> I{LLM provider router}
    I -->|key configured| J[selected provider]
    I -->|fallback| K[Hugging Face Inference]
    I -->|air-gapped| L[Local llama.cpp]

    style A fill:#3b82f6,stroke:#2563eb,color:#fff
    style E fill:#8b5cf6,stroke:#7c3aed,color:#fff
    style I fill:#f59e0b,stroke:#d97706,color:#0f172a
    style J fill:#10b981,stroke:#059669,color:#fff

More: architecture.

Use cases

  • Triage one alert quickly with classification, MITRE mapping, and a SOC-style playbook.
  • Bulk-process a CSV export from your SIEM and get a MITRE coverage report.
  • Hunt across triage history with anomaly scoring and confidence filters.
  • Save frequently-used filter sets and pin them to the sidebar.
  • Demo automation patterns to leadership: kill chain visualization, case workflow, live tail.
  • Compare LLM providers (OpenAI, Anthropic, Hugging Face, local) on the same incident.
  • Build datasets and pipelines on top of the synthetic generator.
  • Study uncertainty-aware classification with configurable thresholds.
  • Explore TF-IDF + embedding hybrids end-to-end via 12 Jupyter notebooks.
  • Use the synthetic dataset for SOC automation experiments.

Quick examples

Launch the SOC console

streamlit run app.py

CLI

# Single classification
nlp-triage --text "User clicked a phishing link in their inbox"

# JSON output for scripting
nlp-triage --text "..." --json

# Bulk with LLM second opinion
nlp-triage --bulk incidents.csv --use-llm --difficulty soc-medium

Synthetic data

python generator/generate_cyber_incidents.py --n-events 1000

What's inside

Component Description
Streamlit console app.py plus assets/styles.css. SOC-themed, dark mode only.
Classifier TF-IDF (5000 dims) + sentence-transformer embeddings (384 dims) + Logistic Regression.
LLM clients HuggingFaceInferenceClient, OpenAIClient, AnthropicClient, LocalLLMClient.
Database SQLite. History, bookmarks, notes, case status, case timeline, saved searches.
CLI nlp-triage. JSON output, bulk processing, LLM second opinion, difficulty modes.
Notebooks 12 Jupyter notebooks covering preprocessing, baselines, evaluation, hybrid models.
Generator LLM-enhanced synthetic dataset creation with monitoring.
Tests Pytest with CI.

Documentation map

License and attribution

  • License: Apache 2.0. See LICENSE.
  • MITRE ATT&CK marks and content used under MITRE's terms of use. See MITRE attribution.