Threat intelligence that surfaces signal

Client

Netviss

ML-driven anomaly detection for SOC teams.

Project

Tasks

• Ingest firewall, endpoint, and cloud logs into a unified timeline
• Train anomaly models with analyst feedback loops
• Surface ranked incidents with natural language summaries
• Integrate with existing ticketing without replacing SIEM

KPIs

1. 1. 50% faster triage — median time to first actionable insight
2. 2. Lower false positives — ranked queue vs. raw alert flood
3. 3. Analyst adoption — daily active use within first month

Project journey

1. 1. Data foundation

   Normalized schemas and retention policies for SOC search.

2. 2. Model sprint

   Trained and evaluated anomaly detectors on historical incidents.

3. 3. SOC integration

   Ranked incident UI embedded in analyst workflow.

Challenges

Netviss needed systems that could scale with operational complexity — replacing manual coordination and disconnected tools that slowed decision-making.

• Manual workflows consumed team capacity and introduced errors at scale.
• Legacy tooling could not support modern analytics or automation requirements.
• Integration gaps between departments created data silos and delayed responses.

Results