Security automation / portfolio case study

Security Shallots

An AI-assisted security monitoring system that combines SIEM telemetry, threat intelligence, cross-event correlation, and local language-model reasoning to surface risks that isolated alerts miss.

24Python source modules
105tests passing in the documented build
4 GBresource-conscious design target
4 layersingest → enrich → correlate → reason
The thesis

Alert volume is not the same as security understanding.

Meaningful risk often appears as a relationship between events, not as one dramatic log line.

Design principle
Preserve evidence first. Enrich it second. Correlate it before asking an AI model to explain what it means.
Evidence and boundaries

Operational evidence

The project includes detection rules, abuse.ch and URLhaus feeds, VirusTotal reputation enrichment, vulnerability/exploit correlation, a web dashboard, and automated tests.

Portfolio-safe presentation

This case study uses synthetic examples and omits real hostnames, addresses, credentials, and private infrastructure details.