Security Assistant
Conversational SOC Analytics Copilot
A production module inside a Security Command Center (SCC) platform: a chat copilot that lets analysts ask plain-language questions across every security dataset — credential leaks, threat intel, brand-impersonation, threat hunting, blocked/released IOCs, takedowns — and answers by calling the right data tools, writing read-only SQL on the fly, and streaming its reasoning, tool calls, and results live.
// Overview
What it does. A SOC platform accumulates dozens of fact tables and document stores, and getting an answer usually means knowing which dashboard to open or which query to write. This assistant removes that friction: an analyst asks in natural language — "show credential leaks for domain X in the last week," "is this IP in our blocklist," "summarize takedowns still in progress" — and the copilot figures out which data source to consult, fetches the records, and replies conversationally. It spans the whole platform: credential leaks, threat-intel IOCs, social-media and web monitoring, threat hunting, blocked and released IOCs, takedowns, and the unstructured/tabular asset stores. The analyst watches it work — each tool call and result streams to the UI in real time — and every conversation is saved as a titled, resumable session.
// Background
The challenge
The platform holds rich security data across many tables.
Getting a quick answer meant knowing the schema or dashboard.
Knowledge scattered across surfaces
Answers lived in many dashboards and fact tables;
you had to know which dashboard to open.
Every question needed dashboard navigation + schema knowledge
Ad-hoc questions needed SQL
Anything off the beaten path — a join, aggregate,
cross-dataset lookup — required hand-writing queries.
SQL fluency was a prerequisite for any unusual question
Context-switching cost time
Mid-incident, hopping between modules to assemble
a picture was slow and broke the investigative flow.
Incident response meant tab-hopping under pressure
Safety mattered
Letting an LLM touch production data demanded hard
guarantees — it can only read, never modify.
Read-only wasn't a preference; it was a hard requirement
Net effect
Rich security data spread across many fact tables, a
schema that gatekeeps non-technical users, and no
conversational surface meant analysts switched dashboards.
// Solution
Security assistant — streaming ReAct copilot over all data
Data sources
Analyst NL question
plain query + session history
streamed via SSE
Security datasets
fact tables + Qdrant/Typesense
read-only sessions
Pipeline
Agent
LangGraph ReAct
session history
Agent
Tools
text-to-SQL (RO)
asset RAG
Tools
Data
PostgreSQL (RO)
Qdrant/Typ.
Data
Portal
Vue 3 chat UI
tool events
UI
LangGraph ReAct agent · text-to-SQL (read-only) · Qdrant + Typesense RAG · SSE streaming · persistent sessions
// Impact
Analytics: SQL → plain language
Before · write SQL
dashboards · SQL · switch modulesAfter · plain language
ask → streamed, cited answer8+
security datasets in one interface
Operational impact
Self-service analytics
answers without schema knowledge
Faster incident response
one surface, no module hopping
Transparent, not magic
tool calls + results stream live
Safe by construction
read-only: cannot mutate prod data
Iterative by design
persistent sessions refine inquiry
Composable reach
reuses datasets, RAG, platform tools
Results
Datasets covered
8+
Session safe
RO
tool stream
SSE
Always available
24/7
Conversations saved as titled sessions ·
auto-generated session title.
// Tech Stack
| Layer | Technologies |
|---|---|
| Agent | LangGraph create_react_agent, LLM (tool-calling, streaming), per-request tool selection |
| Tools | Per-dataset query tools (SQL-style filters), execute_read_only_sql (text-to-SQL, read-only session), Qdrant + Typesense asset RAG |
| Streaming | Server-Sent Events (tool_call / tool_result / message), StreamingResponse |
| Persistence | PostgreSQL chat history (user/session/role/content + auto title), read-only DB session for queries |
| Backend API | FastAPI (Tools API + portal SSE proxy with auth forwarding) |
| Frontend | Vue 3, Quasar, Vite, TypeScript |
// Architecture & Diagrams
Disclaimer: sample visuals may contain anonymized, simulated, or non-production values for presentation purposes.