Barbican
An AI security orchestration platform that cut manual L1/L2 alert triage by about 60%.
The problem
Millions of WAF and SOC alerts a day, most of them near-duplicates. Analysts spent their time re-reading the same story instead of investigating new ones.
What I built
- A production MCP (Model Context Protocol) server on FastAPI and Django that exposes live SOC tools as functions an LLM can call during an investigation
- An embedding pipeline (all-MiniLM sentence-transformers) with FAISS cosine-similarity indexing for semantic deduplication and alert clustering
- Retrieval-augmented investigation that pulls related past incidents into context
The result
Sub-second semantic correlation across millions of daily events, about 60% less manual L1/L2 triage, and roughly 60% faster mean time to investigate.