Synthetic data & simulated integrations. Every incident, host, identity, indicator and detection source on this page is fabricated for portfolio demonstration. There is no live ServiceNow instance, SIEM, EDR or identity provider connected, and this project is not affiliated with or endorsed by ServiceNow.

Docs & Tests

Implementation status

This page is the honest boundary of the project: what actually runs, what is simulated, and what an enterprise deployment would still require.

Unit tests

Vitest, decision logic only

Decision functions

Pure, no I/O, no clock

Live integrations

Everything is simulated

Implemented in this demo

· Typed domain model for incidents, assets, identities, business services, playbooks, tasks, evidence and audit entries
· Deterministic priority scoring with a rendered factor-by-factor trace
· First-match-wins routing with a full rule evaluation trace
· Severity-based acknowledge / contain / resolve SLA budgets with at-risk and breach states
· Escalation ladder derived from SLA pressure, priority and service criticality
· Playbook automation pre-flight with category, severity and confidence gates
· Human-approval gating for high-impact actions and tier0/tier1 production assets
· Hard auto-close prohibition for high and critical incidents
· Labelled, advisory-only simulated AI triage summaries and suggestions
· Evidence register with simulated integrity digests and an audit trail
· Program metrics recomputed from fixtures on every render
· Unit tests over priority, SLA, routing, automation eligibility, auto-close and escalation

Test coverage of the decision logic

See src/lib/soc/logic.test.ts.

Priority calculation	Score composition per factor, band boundaries P1–P4, monotonicity across severity and asset tier.
SLA model	Budget lookup per severity, elapsed/remaining arithmetic, on-track / at-risk / breached thresholds.
Routing	Each rule in isolation, first-match-wins ordering, and the completeness of the evaluation trace.
Automation eligibility	Category, severity and confidence gates; auto-executable vs approval-required partitioning.
Auto-close safety	High and critical incidents are never auto-closeable regardless of state or approval flags.
Escalation	Ladder monotonicity and the trigger reasons attached to each level.

Production-only capabilities

Deliberately absent rather than stubbed to look real.

Authentication & SSO	No login exists; every route is public and read-only.
RBAC / least privilege	Assignment groups are display data, not authorization.
Real integrations	No ServiceNow, SIEM, EDR, identity-provider or ticketing connection exists.
Secret vaulting & rotation	The codebase contains no credentials to store; a real deployment would need a managed vault.
Persistent audit storage	The audit trail is an in-memory fixture; production needs append-only, tamper-evident storage.
Inbound webhooks	No endpoint receives detections; a real intake needs signature verification and replay protection.
Change-management controls	Playbook edits are code changes here; production needs approvals and versioned release control.
Data retention & privacy	No personal or customer data is present, so no retention or DSAR handling is implemented.
Observability	No logging, metrics export or alerting pipeline.

Repository documentation

· README.md — project overview, scope, disclosures and commands.
· docs/architecture.md — layering and data flow.
· docs/incident-workflow.md — state model and lifecycle.
· docs/automation-logic.md — playbook gates and approval rules.
· docs/sla-escalation.md — budgets, thresholds and the ladder.
· docs/security-controls.md — implemented controls and threat notes.
· docs/implementation-status.md — demo vs production matrix.

Not affiliated with or endorsed by ServiceNow. No live ServiceNow, SIEM, EDR, identity-provider, credential, customer-data or production-incident connection exists in this project.