PROJECT CASE STUDY / SANITIZED
Automated Security Incident Enrichment Platform
A reusable processor for gathering deterministic incident evidence, routing relevant enrichment, and producing concise analyst-ready context — without exposing secrets, proprietary data, or internal infrastructure.
ARCHITECTURE
Microsoft Defender → Microsoft Graph API → Evidence ingestion → Evidence normalization → Enrichment routing → Authorized sources → Normalized enrichment → AI summary → Analyst / ticketing workflow
01 / PROBLEM — Responders often need to manually pivot across systems to enrich indicators, understand devices and users, determine reputation, identify asset ownership, and assemble enough context to make a confident decision.
02 / GOAL — Build a reusable incident-enrichment processor that automates deterministic information gathering while preserving analyst judgment for interpretation and disposition.
03 / IMPLEMENTATION — Evidence from Defender and Graph is normalized into predictable PowerShell objects and arrays grouped as device, user, file, IP, and process evidence. Routing only invokes relevant sources: public IPs and hashes to VirusTotal; assets and hostnames to CMDB data; business context to approved internal sources.
04 / RELIABILITY — Defensive handling covers API errors, unavailable enrichment, duplicate indicators, private-versus-public IP filtering, input validation, and stale responses. The resulting workflow favors partial, trustworthy context over brittle all-or-nothing execution.
05 / AI LAYER — Deterministic code gathers and structures facts first. AI receives sanitized structured enrichment to draft a concise analyst-oriented summary; it does not determine ground truth or replace investigation judgment.
06 / SECURITY CONSIDERATIONS — Secrets stay out of source code; credentials use environment or approved secret storage; sample data is sanitized; access is read-only where possible; untrusted external data and prompt injection are treated as explicit design concerns.
07 / OUTCOME — Intended benefits include reduced manual enrichment, faster triage, more consistent investigations, a reusable architecture, and better context for analysts and ticketing workflows.
WHAT I LEARNED — API authentication, REST integrations, JSON parsing, PowerShell object modeling, evidence normalization, resilient error handling, security engineering architecture, and responsible AI integration.