Work / U02

Sovereign

A SOC analyst workspace where one playbook reads as a terse checklist for an analyst mid-incident, or as a fully explained procedure for someone learning.

Role
Solo build
Type
Personal project
When
2026
Stack
Next.js · React · TypeScript · IndexedDB · Zod

How it works

Motion mock-up with demo data. Pasted headers become defanged indicators, the same hunt is written for three SIEMs, and the verdict drops into a report that has already written itself.
  1. 01A phishing alert. Paste the email's headers; the suspicious parts light up.
  2. 02Indicators, defanged. They land in the case stored refanged, shown defanged, so nothing in the report is a live link.
  3. 03One hunt, three SIEMs. The same query, already filled in for Splunk, Elastic and Sentinel.
  4. 04The verdict writes the report. Record it, and the case report exports as Markdown, JSON or PDF.

01Problem

SOC tools for learners split into two halves. Reference tools are fast but teach nothing: you copy a query, it works, and you learn nothing you can reuse. Courseware teaches, but falls apart under pressure. Nobody reads a chapter on email authentication while a phishing alert ages toward its deadline.

02My role

Solo: the product requirements, the design system, the content model, the build and the tests. I practise in TryHackMe's SOC rooms, but every step here is judged by one question: would this make sense on a real queue at 3 a.m.?

03Approach

  1. Write it once, read it at three depths.Each playbook is authored once and shown as Guided, Standard or Expert with a toggle, from a full explanation down to a checklist.
  2. One loop, end to end.Paste email headers into the IOC extractor, and the indicators land in the case. Every query fills itself in from them, checklist ticks and pivots log themselves to the timeline, and the verdict feeds a report that's already written.
  3. Three SIEMs, side by side.Each detection is written for Splunk (SPL), Elastic (Kibana KQL) and Microsoft Sentinel (Kusto), with a compare view. A build check rejects a bare “KQL”, because it names two different languages.
  4. Case data never leaves the browser.No backend, no telemetry, no analytics. Analysts paste real indicators and headers, so everything stays in the browser's own storage.
  5. Handle evidence like evidence.Indicators are stored refanged and shown defanged, so the readable report has no live links. The timeline is append-only: a correction is a new entry that points at the old one.
  6. Content is data, and it's checked.Playbooks follow a schema, a validator runs at build time, and each check has a test that proves it rejects bad content. Every command and query carries a source and a review date.
  7. Teach the tradecraft.Enrichment lookups warn before they send anything, because probing an attacker's infrastructure can tip them off. Practice alerts score the facts automatically, but the written reasoning is never keyword-matched: the analyst checks it against a rubric.

04Result

The investigation loop works end to end, from pasted headers to a report exported as Markdown, JSON or PDF. It ships playbooks for phishing and suspicious files, reference libraries, a curriculum with practice alerts, and an annotated example report.

Next: browser-level accessibility testing, offline support, and more playbooks.