Synthetic data & simulated integrations. Every incident, host, identity, indicator and detection source on this page is fabricated for portfolio demonstration. There is no live ServiceNow instance, SIEM, EDR or identity provider connected, and this project is not affiliated with or endorsed by ServiceNow.

Architecture & Security

How the lab is built

A single-page TanStack Start application. All decision logic is pure TypeScript over typed fixtures, so every screen is deterministic and every number is reproducible in a unit test.

Data & decision flow

Fabricated detection sources (SIM-SIEM / SIM-EDR / SIM-CloudTrail /
SIM-MailGateway / SIM-IdentityProvider / SIM-VulnScanner / SIM-UserReport)
        |
        v
  Intake & normalization  ->  dedupe key  ->  aggregate confidence
        |
        v
  Deterministic decision core  (src/lib/soc/logic.ts, pure + unit tested)
    - computePriority   severity + confidence + asset tier + service
                        criticality + identity risk + SLA age
    - routeIncident     first-match-wins rules, full evaluation trace
    - computeSla        ack / contain / resolve budgets per severity
    - evaluateAutomation  playbook pre-flight + human-approval gating
    - evaluateEscalation  tier2 -> incident commander -> executive
    - canAutoClose      hard block on high/critical
        |
        v
  Derived views (src/lib/soc/derive.ts)  ->  React routes + primitives
        |
        v
  Simulated actions -> response tasks + evidence + audit entries (in memory)

Layers

  • types.ts — domain model; synthetic naming is enforced at the type level (source names carry a “(synthetic)” suffix).
  • logic.ts — pure decision functions. No I/O, no randomness, no clock reads: ages are precomputed in minutes.
  • fixtures.ts — the synthetic incident set, assets, identities, services, playbooks, tasks, evidence and audit entries.
  • derive.ts — enrichment and program metrics.
  • components/soc — the shell and presentation primitives, including the mandatory disclosure components.
  • routes/ — one route per dashboard section.

Implemented security controls

Hard auto-close block for high and critical incidents, unit tested.

Human-approval gating for every high-impact action, and for any non-trivial action on a tier0 or tier1 production asset.

Explainability by construction: priority factors, routing rule traces and automation reasons are rendered, not summarised.

Simulated AI output is labelled everywhere it appears and is advisory only.

No secrets, credentials, tokens or network calls exist anywhere in the codebase.

Production-only requirements (explicitly NOT implemented)

These are documented as gaps rather than faked.

Authentication & SSORBAC / least privilegeReal ServiceNow / SIEM / EDR / IdP integrationsSecret vaulting & rotationPersistent immutable audit storageSigned inbound webhooksChange-management approvalsData retention & privacy controlsRate limiting & abuse protectionObservability & alerting

This project must never be deployed as an operational security tool. It is a portfolio artifact: no live instance, no production incidents, no customer data, and no affiliation with or endorsement by ServiceNow.