Alerts Module

Overview

The Alerts module is the frontline of the ThreatOps SOCaaS platform. In a multi-tenant security operations center, thousands of alerts stream in every hour from customer SIEM deployments (Sentinel, Splunk, CrowdStrike, Elastic, Chronicle). Without intelligent triage, SOC analysts face overwhelming alert fatigue and critical threats slip through.

This module provides real-time alert ingestion, AI-powered scoring and disposition, bulk analyst actions, and autonomous auto-resolution for known benign patterns. It is the primary data source for the Incidents, Dashboard, and MDR modules.

What Was Proposed

• Multi-SIEM alert ingestion from 5+ SIEM platforms (Sentinel, Splunk, CrowdStrike, Elastic, Chronicle)
• 6-stage AI triage pipeline: entity extraction, threat intelligence enrichment, UEBA behavioral analysis, correlation, rule-based scoring, and ML ensemble scoring
• Automatic disposition with score blending (70% ML + 30% rule-based)
• Bulk analyst actions (resolve, escalate, mark false positive) with ML feedback loop
• Real-time WebSocket notifications on new and triaged alerts
• Alert statistics and auto-resolution rate tracking
• Autonomous SOC integration for auto-processing incoming alerts

What's Built

Architecture

Backend Service: TriageService

The core AI engine lives in app/services/triage_service.py. It orchestrates a 6-stage async pipeline:

1. Entity Extraction — Parses alert payloads for IPs, domains, hashes, and usernames via EntityExtractor
2. Threat Intelligence Enrichment — Parallel multi-provider lookups for IPs, domains, and file hashes via ThreatIntelAggregator
3. UEBA Analysis — Behavioral deviation scoring for users via UEBAService
4. Correlation — Checks for matching entities across alerts in the last 24 hours
5. ML Scoring — Rule-based risk scoring via RiskScoringModel
6. ML Ensemble — sklearn models (AlertClassifier RF, AnomalyDetector IF, ThreatScorer GB) with 70/30 blend

Dispositions: benign_auto_resolved, requires_investigation, suspicious_escalate, critical_immediate

API Router

File: app/routers/alerts.py — Prefix: /api/v1/alerts

GET    /api/v1/alerts/              # List alerts (filters: status, severity, source_siem)
POST   /api/v1/alerts/              # Create alert (triggers autonomous SOC + notifications)
PATCH  /api/v1/alerts/{alert_id}    # Update alert fields
GET    /api/v1/alerts/stats         # Alert statistics (total, new, auto_resolved, escalated, rate)
POST   /api/v1/alerts/{alert_id}/triage  # Trigger 6-stage AI triage on an alert
POST   /api/v1/alerts/bulk          # Bulk action (resolve, escalate, false_positive) + ML feedback

Frontend Page

File: src/app/alerts/page.tsx

The frontend calls GET /api/v1/alerts/ on mount, falling back to mock data. It renders a stats bar (new, investigating, auto-resolved, escalated counts), a bulk action toolbar, and a sortable table with AI score progress bars, severity badges, SIEM source, and disposition labels. Analysts can select multiple alerts and bulk-resolve or bulk-escalate via PATCH /api/v1/alerts/{id}.

Routing

Prerequisites

• Database — PostgreSQL with async SQLAlchemy (app/core/database.py)
• Tenant Middleware — Sets request.state.tenant_id for multi-tenant scoping
• ML Pipeline — app/ml/training_pipeline.py for ensemble predictions and feedback recording
• Notification Service — app/services/notification_service.py for WebSocket push
• Autonomous SOC — app/services/autonomous_soc.py for auto-processing
• SLA Manager — app/services/sla_manager.py for response time tracking
• Entity Extractor, Threat Intel, UEBA — Supporting triage pipeline services

Data Model

Model: app/models/alert.py — Table: alerts (extends TenantScopedBase)

UI Layout