Sequence-modelling pipeline
Python services normalize events, tokenize activity, build profiles, train sequence models, and export inference artifacts.
Case study
Narrative Security
A behavioural security analytics prototype that links event normalization, sequence modelling, edge-oriented inference, and analyst review.
01 / 07
Product inventory
Recorded scope across routes, data models, interface screens, and workflow code.
- Page routes
- 27
- OCSF schema files
- 78
- Python tests
- 22
- Model artifacts
- 12
- Runtime path
- Cloudflare
Project overview
A behavioural security analytics prototype that links event normalization, sequence modelling, edge-oriented inference, and analyst review.
Isolated security events rarely explain behaviour. The prototype normalizes authentication, process, file, and access activity into behavioural sequences, compares them with user and peer context, and presents the result for analyst review. A model score begins the investigation; it does not settle it.
What was built
The prototype converts raw activity into behavioural sequences and anomaly scores, then exposes the evidence and peer context to an analyst.
SOC dashboard
Analyst screens show queue state, alerts, user risk, timelines, peer context, recommendations, and resolution workflows.
Edge inference architecture
Worker gateway, Python inference containers, queues, KV, R2 artifacts, D1 records, and active-version switching outline a Cloudflare runtime path.
Validation and audit model
Pydantic/Zod contracts, exercise-data review, audit records, benchmark-style pages, and model exposition pages keep the prototype inspectable.
Validation
Pydantic and Zod service boundaries.
Artifacts
Bundles, vocabularies, templates, versions.
Selected details
Implementation details from the product, data, workflow, and infrastructure layers.
- 01
Contract-driven Python services with Pydantic validation.
- 02
Runtime validation in TypeScript with Zod and hardened security headers.
- 03
Model bundle export, quantization, artifact upload, and active-version switching workflows.
- 04
Dashboard screens for triage, analytics, data exploration, users, settings, and operational administration.
- 05
System components map across Events, Gateway, Linguist, Profiler, Predictor, Investigator, and Dashboard screens.
- 06
Cloudflare deployment paths include Workers, D1, KV, R2, queues, containers, and Access-oriented configuration.
- 07
LANL-style and red-team artifacts support benchmark-style review, alert inspection, and model evaluation.
- 08
Security headers, audit records, validation contracts, and model exposition pages make the workflow inspectable.
Systems overview
How the public pages, staff workflows, data, review steps, and infrastructure connect.
Events
Structured security telemetry.
Tokenization
Sequence-ready behavioural inputs.
Model
Anomaly scoring and inference artifacts.
Alert store
Severity, status, recommendations.
Analyst UI
Triage, timelines, analytics, settings.
Technology
Languages, frameworks, data stores, and infrastructure.
Design language
A security-operations visual language: dark review panels, compact mono labels, sparse severity colour, table-first evidence, queue state, and diagrams that explain the model path.
Philosophy
Security analytics as review workflow
The product framing keeps the model visible but subordinate to analyst review: event context, peer comparison, queue state, validation, and auditability do the explanatory work.
Analyst queuesPeer contextExercise reviewModel exposition
Aa
System sans, mono utility, severity symbolsAnalyst panels, IDs, risk state
Graphite#0c1117
Panel#151d27
Cyan#45d6d8
Purple#8b6ff7
Severity#f59e0b
Selected screens
More screens showing the product in use.