ATLAS
SIEM, response playbooks, and an AI analyst connected through a threat graph.
The project ↓ATLAS, the Autonomous Threat & Log Analysis System, is a next-generation SOC built by IntelBrokers at ESPRIT. It connects detection, investigation, and response in a simulated banking environment.
- The problem
- Detection, investigation, and response need to share the same event context across a segmented banking lab.
- The solution
- SIEM monitoring across six zones, five response playbooks, and an AI analyst that uses graph evidence and policy context.
- The outcome
- A connected SOC lab for detection, investigation, and response, awarded 1st place in its category at Bal des Projets 2026.
How it works.
Collect the event context.
SIEM logs, Suricata detections, and indicator checks provide the starting evidence across the lab’s network zones.
Follow the relationships.
Neo4j links users, hosts, and processes. The AI analyst uses graph and policy context to explain an investigation.
Connect findings to a response.
Automated playbooks connect the investigation with containment actions and reporting.
Project images.
Technical notes
SIEM and response automation
ELK and Wazuh correlate logs across six network zones. Five SOAR playbooks connect alerts to response actions. Suricata, MISP indicator correlation, and honeypots add detection context.
An analyst that can query the relationships
Neo4j connects users, hosts, processes, and network events. The AI analyst can work with that graph, answer investigation questions, and prepare reports. The gallery shows the query view and a graph-supported lateral-movement explanation.
Streaming and policy context
Apache Kafka carries event streams between components. A policy-based access-control engine and retrieved organizational guidance provide policy context, with ISO 27001, NIST, and SOC 2 used as framework references.
Recognition at ESPRIT
ATLAS received 1st place in the Network, Infrastructure and Data Security category at Bal des Projets 2026. The project brings the SOC components together in a segmented lab, with investigation views, response workflows, and reporting.