// tech stack
Next.jsTypeScriptWebSocketPythonTensorFlowPostgreSQLRedis
// the challenge
Enterprise clients needed sub-100ms threat detection with a zero-downtime requirement. Legacy SIEM tools were producing 40% false positives, causing alert fatigue.
// the solution
Architected a streaming data pipeline using WebSocket + Redis Pub/Sub. Built a custom ML inference layer in Python (FastAPI) and a React dashboard with virtualized lists for 100K+ event rows.
// measurable impact
Reduced mean time to detect (MTTD) from 8 minutes to 47 seconds. False positive rate dropped to 0.8%.
- Timeline
- 6 months
- Team
- 4 engineers
- Role
- Frontend Lead + Security Architect
// key highlights
- ◆Real-time WebSocket event streaming with automatic reconnection
- ◆Custom rule engine with drag-and-drop threat logic builder
- ◆End-to-end encrypted audit logs with tamper detection
- ◆Automated compliance reports (SOC2, ISO27001)
// implementation sample
// Real-time threat stream with auto-reconnect
const useThreatStream = (endpoint: string) => {
const [threats, setThreats] = useState<Threat[]>([]);
useEffect(() => {
let ws: WebSocket;
let retries = 0;
const connect = () => {
ws = new WebSocket(endpoint);
ws.onmessage = ({ data }) => {
const threat = JSON.parse(data) as Threat;
setThreats(prev => [threat, ...prev].slice(0, 1000));
};
ws.onclose = () => {
if (retries < 5) setTimeout(connect, Math.pow(2, retries++) * 1000);
};
};
connect();
return () => ws?.close();
}, [endpoint]);
return threats;
};