DalilProject file 13 of 13
back to library
15

Security prototype

Foundation demo · 2026

Dalil: Local-First SOC Triage

Alert volume hides the stories analysts need to investigate.

Role
Creator and engineer

System summary

Explanatory system view — not a product screenshot.

Posture
Fast first · generative last
Data
Local

Deterministic evidence comes before generation

  1. CSV + JSON alertsLocal import
  2. Canonical alertsField mapping
  3. Grouped storiesRelated events
  4. Deterministic scoreFast first
  5. Evidence packetInspectable basis
  6. DashboardOptional generation later
  • CSV + JSON alertsCanonical alerts
  • Canonical alertsGrouped stories
  • Grouped storiesDeterministic score
  • Deterministic scoreEvidence packet
  • Evidence packetDashboard

The work, in five lines

Problem
Alert volume hides the stories analysts need to investigate.
Owned
I built import, grouping, scoring, evidence, and dashboard foundations.
Changed
Local alerts become grouped, inspectable stories.
Difficult
Deterministic evidence must precede optional language generation.
Verified
Describe only the implemented foundation demo.

Open the evidence

Evidence boundary

No public artifact is linked for this project.

Describe only the implemented foundation demo.