Security Assistant
Conversational SOC Analytics Copilot
Conversational SOC Analytics Copilot
// Overview
A production module inside a Security Command Center (SCC) platform: a chat copilot that lets analysts ask plain-language questions across every security dataset, credential leaks, threat intel, brand-impersonation, threat hunting, blocked/released IOCs, takedowns, and answers by calling the right data tools, writing read-only SQL on the fly, and streaming its reasoning, tool calls, and results live.
// Background
The challenge
The platform holds rich security data across many tables.
Getting a quick answer meant knowing the schema or dashboard.
Knowledge scattered across surfaces
Answers lived in many dashboards and fact tables;
you had to know which dashboard to open.
Every question needed dashboard navigation + schema knowledge
Ad-hoc questions needed SQL
Anything off the beaten path, a join, aggregate,
cross-dataset lookup, required hand-writing queries.
SQL fluency was a prerequisite for any unusual question
Context-switching cost time
Mid-incident, hopping between modules to assemble
a picture was slow and broke the investigative flow.
Incident response meant tab-hopping under pressure
Safety mattered
Letting an LLM touch production data demanded hard
guarantees, it can only read, never modify.
Read-only wasn't a preference; it was a hard requirement
Net effect
Rich security data spread across many fact tables, a
schema that gatekeeps non-technical users, and no
conversational surface meant analysts switched dashboards.
// Solution
Security assistant, streaming ReAct copilot over all data
Data sources
Analyst NL question
plain query + session history
streamed via SSE
Security datasets
fact tables + Qdrant/Typesense
read-only sessions
Pipeline
Agent
LangGraph ReAct
session history
Agent
Tools
text-to-SQL (RO)
asset RAG
Tools
Data
PostgreSQL (RO)
Qdrant/Typ.
Data
Portal
Vue 3 chat UI
tool events
UI
LangGraph ReAct agent · text-to-SQL (read-only) · Qdrant + Typesense RAG · SSE streaming · persistent sessions
// Impact
Analytics: SQL → plain language
Before · write SQL
dashboards · SQL · switch modulesAfter · plain language
ask → streamed, cited answer8+
security datasets in one interface
Operational impact
Self-service analytics
answers without schema knowledge
Faster incident response
one surface, no module hopping
Transparent, not magic
tool calls + results stream live
Safe by construction
read-only: cannot mutate prod data
Iterative by design
persistent sessions refine inquiry
Composable reach
reuses datasets, RAG, platform tools
Results
Datasets covered
8+
Session safe
RO
tool stream
SSE
Always available
24/7
Conversations saved as titled sessions ·
auto-generated session title.
// Tech Stack
| Layer | Technologies |
|---|---|
| Agent | LangGraph create_react_agent, LLM (tool-calling, streaming), per-request tool selection |
| Tools | Per-dataset query tools (SQL-style filters), execute_read_only_sql (text-to-SQL, read-only session), Qdrant + Typesense asset RAG |
| Streaming | Server-Sent Events (tool_call / tool_result / message), StreamingResponse |
| Persistence | PostgreSQL chat history (user/session/role/content + auto title), read-only DB session for queries |
| Backend API | FastAPI (Tools API + portal SSE proxy with auth forwarding) |
| Frontend | Vue 3, Quasar, Vite, TypeScript |
// Architecture & Diagrams
A chat copilot that queries the platform's own data modules through tools and returns tables, charts and exports.
Disclaimer: sample visuals may contain anonymized, simulated, or non-production values for presentation purposes.