live
Breach Precursor Detector
Isolation Forest anomaly detection over multi-source EDR telemetry with confidence gating, SHAP explanations, and an analyst triage dashboard.
- Cybersecurity
- Detection
- ML
- EDR
Overview
Breach Precursor Detector processes CrowdStrike Falcon, Sysmon, and Windows 4688 telemetry with Pandas and PyArrow, engineering 12 interpretable behavioral features and applying Isolation Forest anomaly detection with confidence gating to reduce false-positive alert volume. An interactive Streamlit dashboard supports analyst triage with risk visualization, filtering/export, and hybrid explanations combining rule-based SOC text with SHAP top-feature attribution — containerized with Docker and CI across Python 3.11/3.12.
Highlights
- Multi-source EDR telemetry with 12 engineered behavioral features
- Isolation Forest + confidence gating to cut false positives
- Hybrid SHAP + rule-based SOC explanations for analysts
- Dockerized Streamlit triage dashboard with CI/CD