05
Awarded team prototype
Awarded prototype · 2nd Place · 2026
D3CISION: Explainable SOC Triage
Alert queues hide which events belong together.
- Role
- Hackathon team contributor; research follow-on
Public team artwork
Events become explainable investigation stories
- Security eventsNoisy queue
- Clean + correlateRelated activity
- Investigation storiesGrouped before scoring
- XGBoost scoreRanked stories
- SHAP driversVisible features
- Analyst reviewNo autonomous action
- Security eventsClean + correlate
- Clean + correlateInvestigation stories
- Investigation storiesXGBoost score
- XGBoost scoreSHAP drivers
- SHAP driversAnalyst review
The work, in five lines
- Problem
- Alert queues hide which events belong together.
- Owned
- I contributed to the rapid product and data build.
- Changed
- Events became ranked stories with visible model drivers.
- Difficult
- Useful prioritization had to remain explainable to analysts.
- Verified
- 2nd Place: End-to-end prototype · 2nd Place
Open the evidence
- Team repositoryEnd-to-end prototype (opens in a new tab)
- Challenge result2nd Place (opens in a new tab)
The public repository supports the end-to-end prototype and 2nd Place result while preserving team attribution.