Security alert explainer

The brief

Junior analysts and IT staff struggle to read security alerts. Build an app that explains an alert or log line in plain language, maps it to a MITRE ATT&CK technique where possible, rates the likely risk, and suggests the next step, with the cost of each answer. Good looks like: explanations checked on 40 real alerts, correct ATT&CK mapping, and honest uncertainty.

What you will build

1. Collect 40 alerts and log lines from public data
2. Design prompts that explain, map and rate risk
3. Ground technique mapping in MITRE ATT&CK
4. Check explanations with a reviewer
5. Build the app and report quality and cost

Free, open data to build it with

• MITRE ATT&CK ↗ MITRE
• Loghub: system log datasets ↗ LogPAI (GitHub)

Check each dataset's licence before you publish your work. Your mentor gives your team its own version of the brief (data, scope or region), so every team's project is its own.