02 / THE BUILDER DISTRICT
IDEAS INTO
OPERATIONS.
Open a mission. Explore the architecture.
Take the workflow for a test run.
From alert noise
to a response plan.
The real project ingests alerts from CrowdStrike, Sentinel, Splunk, and Wazuh. Claude classifies the alert, technique IDs are checked against the loaded ATT&CK catalog, and the pipeline generates a response playbook.
ARCHITECTURE & SAFEGUARDS
- Catalog validation filters nonexistent technique IDs before generation.
- Exponential-backoff retries handle transient API failures.
- Partial recovery preserves earlier classification and mapping.
- Bring-your-own-key design avoids server-side credential persistence and cross-user sharing.
SOURCE / Splunk
powershell.exe launched with an encoded command from an unusual parent process.
01INGEST02CLASSIFY03VALIDATE04PLAYBOOK
Waiting for your signal. Select a scenario and run the demo.