Version:
Last updated: 2026-03-28

PRISM

Decomposing threats. Composing clarity.

Project NamePRISM
TypeAI Exploration — Concept Prototype
Product OwnerWen Liu
Tech StackNext.js 16 + React 19 + Tailwind CSS v4 (Single-file interactive prototype)
Current Versionv1.0
Doc Statusv1.0
Live Demowensproject.com/ai-explorations/prism-demo

Version History

VersionDateChangesAuthor
v1.02026-03-28Initial version: full PRDWen Liu

1. Background & Problem

Current Problems

  • SOC analysts face fragmented alert data without a unified threat context view
  • MITRE ATT&CK framework is industry standard, but its mapping in actual tools is often unintuitive
  • Threat response typically requires switching between multiple tools, increasing MTTR
  • 40% of operators abandon triage because raw ML outputs are incomprehensible

Design Opportunity

  • Visualize MITRE ATT&CK technique mapping as an intuitive interactive dashboard
  • Create an end-to-end SOC workflow: Detect → Investigate → Respond → Verify
  • Demonstrate AI explainability design applied to cybersecurity

2. Goals & Metrics

Goal TypeDescriptionMetricTarget
EfficiencyUnify alert → investigate → respond in one interfaceTool-switching count5+ → 1
ComprehensionML scores → readable risk summariesTriage abandonment40% → <10%
SpeedAutomated response executionMTTR-60%
PortfolioSecurity + AI design capabilityInterview impact—

3. Users & Scenarios

Target User Persona

AttributeDescription
RoleSOC Analyst (Tier 1-2)
EnvironmentSOC, 24/7 shift rotation
Pain PointsAlert fatigue, tool-switching, unexplainable ML
GoalsFast triage, accurate response, reduced MTTR

User Journey Map

1

Dashboard Overview

TouchpointPRISM main dashboard
ActionView active incidents, severity, MITRE tags
EmotionAlert — scanning highest priority
2

Incident Detail + ATT&CK Map

TouchpointIncident detail → ATT&CK matrix
ActionView attack chain, affected assets, timeline
EmotionFocused — understanding attack path
3

Automated Response

TouchpointResponse panel — auto-execution + progress
ActionConfirm → auto-execute isolate/reset/notify
EmotionTrust — step-by-step visibility
4

Summary + Dashboard Update

TouchpointSummary → dashboard update
ActionReview actions, confirm status change
EmotionSatisfied — contained and updated

4. Feature List

ModuleFeaturePriorityStatus
DashboardActive incident list (severity + MITRE + status)P0v1.0 ✅
DashboardIncident stats overviewP0v1.0 ✅
Incident DetailAttack chain + timelineP0v1.0 ✅
ATT&CK MapATT&CK matrix interactive viewP0v1.0 ✅
ResponseAuto-response + progress animationP0v1.0 ✅
SummaryResponse summary reportP0v1.0 ✅
DashboardReal-time status updateP0v1.0 ✅
Navigation6-screen interactive navigationP0v1.0 ✅
AI TriageML score explainabilityP1v2
CollaborationCollaborative triage + handoffP2Planned

5. Detailed Design

5.1 Dashboard

Interaction Flow

flowchart TD A[Dashboard loads] --> B[Display incident stats bar] B --> C[Render incident list sorted by severity] C --> D{User clicks incident row} D --> E[Navigate to Incident Detail] C --> F[MITRE tags shown inline per incident] C --> G[Status badges: Open / Investigating / Contained]

Rules

  • Sorted by severity: Critical → High → Medium → Low
  • Each row: ID, title, severity, status, MITRE tags, user, devices, time
  • Stats bar shows per-severity counts

5.2 Incident Detail + ATT&CK Matrix

Interaction Flow

flowchart TD A[Incident Detail Page] --> B[Show attack chain timeline] A --> C[Show affected user + device info] A --> D[Display MITRE ATT&CK tags] D --> E{User clicks ATT&CK tag} E --> F[Highlight technique in ATT&CK matrix] A --> G{User clicks Respond button} G --> H[Navigate to Response panel]

Rules

  • Matrix columns: Initial Access → Execution → Persistence → Credential Access → Lateral Movement → Collection
  • Matched techniques highlighted, others dimmed
  • Click for technique details

5.3 Automated Response

Interaction Flow

flowchart TD A[Response Panel] --> B[Show recommended actions] B --> C["1. Isolate compromised endpoints"] B --> D["2. Reset credentials"] B --> E["3. Block malicious IPs"] B --> F["4. Notify security team"] C & D & E & F --> G{User confirms execution} G --> H[Execute with progress animation] H --> I[Each step shows: Running → Complete] I --> J[All complete → Navigate to Summary]

Rules

  • Sequential execution with progress animation
  • Status: Pending → Running → Complete
  • Auto-navigate to summary on completion

6. Business Flowcharts

Core SOC Workflow

flowchart TD START([Alert Triggered]) --> DASH[Dashboard - View Incidents] DASH --> SELECT{Select Incident} SELECT --> DETAIL[Incident Detail] DETAIL --> ATTACK[ATT&CK Matrix View] ATTACK --> ASSESS{Assess Severity} ASSESS -->|Critical/High| RESPOND[Automated Response Panel] ASSESS -->|Medium/Low| MONITOR[Continue Monitoring] RESPOND --> EXEC[Execute Response Actions] EXEC --> |"1. Isolate"| EXEC EXEC --> |"2. Reset Creds"| EXEC EXEC --> |"3. Block IPs"| EXEC EXEC --> |"4. Notify Team"| EXEC EXEC --> SUMMARY[Response Summary] SUMMARY --> DASH_UPDATE[Dashboard Updated - Status: Contained]

6-Screen Prototype Flow

flowchart LR S1["Screen 1
Dashboard"] --> S2["Screen 2
Incident Detail"] S2 --> S3["Screen 3
ATT&CK Map"] S3 --> S4["Screen 4
Response Execution"] S4 --> S5["Screen 5
Summary"] S5 --> S6["Screen 6
Dashboard Updated"]

7. Edge Cases

ScenarioHandling
No active incidentsEmpty state: All clear
Response action failsRed status + retry + skip option
Unknown ATT&CK techniqueGray tag: Unknown Technique
Demo modeStatic mock data, preset interaction paths

8. Roadmap

PhaseKey FeaturesStatus
v1.06-screen interactive prototypeDone ✅
v2.0AI explainability, ML visualization, real-time dataPlanned
v3.0Collaborative triage, integrationsFuture

9. Appendix

Design Specs

PropertyValue
ThemeDark SOC dashboard
Base BG#0a0f1a
Card BG#141b2d
Accent#3b82f6
SeverityCritical: red / High: orange / Medium: yellow / Low: blue

MITRE ATT&CK Tags Used

ATT&CK techniques in prototype:

  • Initial Access — T1566 Phishing
  • Credential Access — T1003 OS Credential Dumping
  • Lateral Movement — T1021 Remote Services
  • Execution — T1059 Command & Scripting
  • Collection — T1005 Data from Local System
  • Persistence — T1053 Scheduled Task/Job