1"use strict";(self.webpackChunk_N_E=self.webpackChunk_N_E||[]).push([[2951],{66561:(e,t,s)=>{s.d(t,{g:()=>n});var a=s(95155),r=s(12115);function n(e){let{children:t,className:s="",delay:n=0}=e,{ref:i,visible:l}=function(){let e=(0,r.useRef)(null),[t,s]=(0,r.useState)(!1);return(0,r.useEffect)(()=>{let t=e.current;if(!t)return;let a=new IntersectionObserver(e=>{let[t]=e;t.isIntersecting&&(s(!0),a.disconnect())},{threshold:.15});return a.observe(t),()=>a.disconnect()},[]),{ref:e,visible:t}}();return(0,a.jsx)("div",{ref:i,className:"transition-all duration-700 ease-out ".concat(l?"translate-y-0 opacity-100":"translate-y-8 opacity-0"," ").concat(s),style:{transitionDelay:"".concat(n,"ms")},children:t})}},82951:(e,t,s)=>{s.r(t),s.d(t,{default:()=>y});var a=s(95155),r=s(27937),n=s(35626),i=s(52619),l=s.n(i),o=s(66561);function c(e){let{x:t,y:s,type:r,color:n}=e;return({globe:(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)("circle",{cx:t,cy:s,r:"8",fill:"none",stroke:n,strokeWidth:"1.2"}),(0,a.jsx)("ellipse",{cx:t,cy:s,rx:"4",ry:"8",fill:"none",stroke:n,strokeWidth:"0.8"}),(0,a.jsx)("line",{x1:t-8,y1:s,x2:t+8,y2:s,stroke:n,strokeWidth:"0.6"})]}),shield:(0,a.jsx)(a.Fragment,{children:(0,a.jsx)("path",{d:"M".concat(t,",").concat(s-9," L").concat(t+7,",").concat(s-5," L").concat(t+7,",").concat(s+2," Q").concat(t+7,",").concat(s+8," ").concat(t,",").concat(s+9," Q").concat(t-7,",").concat(s+8," ").concat(t-7,",").concat(s+2," L").concat(t-7,",").concat(s-5," Z"),fill:"none",stroke:n,strokeWidth:"1.2"})}),brain:(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)("circle",{cx:t-3,cy:s-3,r:"5",fill:"none",stroke:n,strokeWidth:"1"}),(0,a.jsx)("circle",{cx:t+3,cy:s-3,r:"5",fill:"none",stroke:n,strokeWidth:"1"}),(0,a.jsx)("path",{d:"M".concat(t-5,",").concat(s+2," Q").concat(t,",").concat(s+8," ").concat(t+5,",").concat(s+2),fill:"none",stroke:n,strokeWidth:"1"})]}),chart:(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)("rect",{x:t-7,y:s-7,width:"14",height:"14",rx:"2",fill:"none",stroke:n,strokeWidth:"1"}),(0,a.jsx)("polyline",{points:"".concat(t-4,",").concat(s+3," ").concat(t-1,",").concat(s-1," ").concat(t+2,",").concat(s+1," ").concat(t+5,",").concat(s-4),fill:"none",stroke:n,strokeWidth:"1.2"})]}),gear:(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)("circle",{cx:t,cy:s,r:"4",fill:"none",stroke:n,strokeWidth:"1.2"}),(0,a.jsx)("circle",{cx:t,cy:s,r:"7.5",fill:"none",stroke:n,strokeWidth:"1",strokeDasharray:"3 2.5"})]}),target:(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)("circle",{cx:t,cy:s,r:"7",fill:"none",stroke:n,strokeWidth:"1"}),(0,a.jsx)("circle",{cx:t,cy:s,r:"4",fill:"none",stroke:n,strokeWidth:"1"}),(0,a.jsx)("circle",{cx:t,cy:s,r:"1.5",fill:n})]}),user:(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)("circle",{cx:t,cy:s-4,r:"4",fill:"none",stroke:n,strokeWidth:"1.2"}),(0,a.jsx)("path",{d:"M".concat(t-6,",").concat(s+7," Q").concat(t-6,",").concat(s+1," ").concat(t,",").concat(s+1," Q").concat(t+6,",").concat(s+1," ").concat(t+6,",").concat(s+7),fill:"none",stroke:n,strokeWidth:"1.2"})]}),bolt:(0,a.jsx)(a.Fragment,{children:(0,a.jsx)("polygon",{points:"".concat(t-1,",").concat(s-8," ").concat(t-5,",").concat(s+1," ").concat(t-1,",").concat(s+1," ").concat(t+1,",").concat(s+8," ").concat(t+5,",").concat(s-1," ").concat(t+1,",").concat(s-1),fill:"none",stroke:n,strokeWidth:"1.2"})}),search:(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)("circle",{cx:t-2,cy:s-2,r:"6",fill:"none",stroke:n,strokeWidth:"1.2"}),(0,a.jsx)("line",{x1:t+2,y1:s+2,x2:t+7,y2:s+7,stroke:n,strokeWidth:"1.5"})]}),antenna:(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)("line",{x1:t,y1:s+7,x2:t,y2:s-3,stroke:n,strokeWidth:"1.2"}),(0,a.jsx)("path",{d:"M".concat(t-5,",").concat(s-5," Q").concat(t,",").concat(s-9," ").concat(t+5,",").concat(s-5),fill:"none",stroke:n,strokeWidth:"1.2"}),(0,a.jsx)("path",{d:"M".concat(t-3,",").concat(s-3," Q").concat(t,",").concat(s-6," ").concat(t+3,",").concat(s-3),fill:"none",stroke:n,strokeWidth:"1"}),(0,a.jsx)("circle",{cx:t,cy:s+7,r:"1.5",fill:n})]}),inbox:(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)("rect",{x:t-7,y:s-5,width:"14",height:"10",rx:"2",fill:"none",stroke:n,strokeWidth:"1.2"}),(0,a.jsx)("polyline",{points:"".concat(t-7,",").concat(s-5," ").concat(t,",").concat(s+1," ").concat(t+7,",").concat(s-5),fill:"none",stroke:n,strokeWidth:"1"})]}),alert:(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)("path",{d:"M".concat(t,",").concat(s-8," L").concat(t+8,",").concat(s+6," L").concat(t-8,",").concat(s+6," Z"),fill:"none",stroke:n,strokeWidth:"1.2"}),(0,a.jsx)("line",{x1:t,y1:s-3,x2:t,y2:s+1,stroke:n,strokeWidth:"1.5"}),(0,a.jsx)("circle",{cx:t,cy:s+4,r:"1",fill:n})]}),disk:(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)("rect",{x:t-7,y:s-6,width:"14",height:"12",rx:"2",fill:"none",stroke:n,strokeWidth:"1.2"}),(0,a.jsx)("line",{x1:t-4,y1:s-3,x2:t+4,y2:s-3,stroke:n,strokeWidth:"0.8"}),(0,a.jsx)("circle",{cx:t+3,cy:s+2,r:"1.5",fill:n})]}),lock:(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)("rect",{x:t-5,y:s-2,width:"10",height:"8",rx:"1.5",fill:"none",stroke:n,strokeWidth:"1.2"}),(0,a.jsx)("path",{d:"M".concat(t-3,",").concat(s-2," L").concat(t-3,",").concat(s-5," Q").concat(t-3,",").concat(s-9," ").concat(t,",").concat(s-9," Q").concat(t+3,",").concat(s-9," ").concat(t+3,",").concat(s-5," L").concat(t+3,",").concat(s-2),fill:"none",stroke:n,strokeWidth:"1.2"})]}),monitor:(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)("rect",{x:t-7,y:s-6,width:"14",height:"10",rx:"1.5",fill:"none",stroke:n,strokeWidth:"1.2"}),(0,a.jsx)("line",{x1:t,y1:s+4,x2:t,y2:s+7,stroke:n,strokeWidth:"1"}),(0,a.jsx)("line",{x1:t-4,y1:s+7,x2:t+4,y2:s+7,stroke:n,strokeWidth:"1"})]}),list:(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)("rect",{x:t-7,y:s-7,width:"14",height:"14",rx:"2",fill:"none",stroke:n,strokeWidth:"1"}),(0,a.jsx)("line",{x1:t-4,y1:s-3,x2:t+4,y2:s-3,stroke:n,strokeWidth:"0.8"}),(0,a.jsx)("line",{x1:t-4,y1:s,x2:t+4,y2:s,stroke:n,strokeWidth:"0.8"}),(0,a.jsx)("line",{x1:t-4,y1:s+3,x2:t+4,y2:s+3,stroke:n,strokeWidth:"0.8"})]}),loop:(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)("path",{d:"M".concat(t+6,",").concat(s-2," A6,6 0 1,0 ").concat(t,",").concat(s+6),fill:"none",stroke:n,strokeWidth:"1.2"}),(0,a.jsx)("polygon",{points:"".concat(t-2,",").concat(s+4," ").concat(t+1,",").concat(s+7," ").concat(t+1,",").concat(s+4),fill:n})]})})[r]||null}function d(){return(0,a.jsx)("div",{className:"my-8 flex justify-center",children:(0,a.jsxs)("svg",{viewBox:"0 0 520 300",className:"w-full max-w-xl",role:"img","aria-label":"Detection Layers",children:[(0,a.jsx)("style",{children:"\n @keyframes tdPulse { 0%,100%{opacity:.6} 50%{opacity:1} }\n .td-glow{animation:tdPulse 3s ease-in-out infinite}\n "}),(0,a.jsx)("rect",{x:"10",y:"10",width:"500",height:"280",rx:"16",fill:"#0f172a",stroke:"#1e293b",strokeWidth:"2"}),(0,a.jsx)("text",{x:"260",y:"38",fill:"#e2e8f0",fontSize:"14",fontWeight:"700",textAnchor:"middle",children:"Defense in Depth â Detection Layers"}),[{y:50,label:"Layer 1: Network Perimeter",desc:"IDS/IPS, firewall rules, DDoS mitigation",color:"#3b82f6",w:450},{y:100,label:"Layer 2: Application Layer",desc:"WAF, rate limiting, input validation, bot detection",color:"#8b5cf6",w:390},{y:150,label:"Layer 3: Behavioral Analysis",desc:"ML anomaly detection, user behavior analytics (UEBA)",color:"#06b6d4",w:330},{y:200,label:"Layer 4: Endpoint Detection",desc:"Process monitoring, file integrity, memory analysis",color:"#f59e0b",w:270},{y:250,label:"Layer 5: Data Layer",desc:"Access anomalies, exfiltration detection, DLP",color:"#ef4444",w:210}].map((e,t)=>(0,a.jsxs)("g",{className:"td-glow",style:{animationDelay:"".concat(.3*t,"s")}
1,children:[(0,a.jsx)("rect",{x:(520-e.w)/2,y:e.y,width:e.w,height:"42",rx:"8",fill:"".concat(e.color,"10"),stroke:e.color,strokeWidth:"1.5"}),(0,a.jsx)("text",{x:"260",y:e.y+18,fill:e.color,fontSize:"10",fontWeight:"700",textAnchor:"middle",children:e.label}),(0,a.jsx)("text",{x:"260",y:e.y+34,fill:"".concat(e.color,"70"),fontSize:"7",textAnchor:"middle",children:e.desc})]},t))]})})}function x(){return(0,a.jsx)("div",{className:"my-8 flex justify-center",children:(0,a.jsxs)("svg",{viewBox:"0 0 520 260",className:"w-full max-w-xl",role:"img","aria-label":"Anomaly Detection Pipeline",children:[(0,a.jsx)("style",{children:"\n @keyframes adPulse { 0%,100%{opacity:.6} 50%{opacity:1} }\n @keyframes adFlow { 0%{stroke-dashoffset:12} 100%{stroke-dashoffset:0} }\n .ad-glow{animation:adPulse 3s ease-in-out infinite}\n .ad-flow{stroke-width:1.5;stroke-dasharray:4 3;animation:adFlow 2s linear infinite;fill:none}\n "}),(0,a.jsx)("defs",{children:(0,a.jsx)("marker",{id:"adArr",viewBox:"0 0 10 10",refX:"9",refY:"5",markerWidth:"6",markerHeight:"6",orient:"auto-start-reverse",children:(0,a.jsx)("path",{d:"M0,0 L10,5 L0,10 z",fill:"#06b6d4"})})}),(0,a.jsx)("rect",{x:"10",y:"10",width:"500",height:"240",rx:"16",fill:"#0f172a",stroke:"#1e293b",strokeWidth:"2"}),(0,a.jsx)("text",{x:"260",y:"38",fill:"#e2e8f0",fontSize:"14",fontWeight:"700",textAnchor:"middle",children:"ML Anomaly Detection Pipeline"}),[{x:20,label:"Collect",sub:"Logs, metrics, events",color:"#3b82f6",icon:"chart"},{x:135,label:"Feature Eng",sub:"Time series, stats",color:"#8b5cf6",icon:"gear"},{x:250,label:"ML Model",sub:"Isolation Forest",color:"#06b6d4",icon:"brain"},{x:365,label:"Score",sub:"Anomaly 0.0 â 1.0",color:"#f59e0b",icon:"target"}].map((e,t)=>(0,a.jsxs)("g",{children:[t>0&&(0,a.jsx)("line",{x1:e.x-18,y1:95,x2:e.x-2,y2:95,stroke:"#475569",strokeWidth:"1.5",markerEnd:"url(#adArr)"}),(0,a.jsxs)("g",{className:"ad-glow",style:{animationDelay:"".concat(.3*t,"s")},children:[(0,a.jsx)("rect",{x:e.x,y:55,width:"110",height:"85",rx:"10",fill:"".concat(e.color,"10"),stroke:e.color,strokeWidth:"1.5"}),(0,a.jsx)("text",{x:e.x+55,y:80,fill:e.color,fontSize:"11",fontWeight:"700",textAnchor:"middle",children:e.label}),(0,a.jsx)("text",{x:e.x+55,y:96,fill:"".concat(e.color,"90"),fontSize:"8",textAnchor:"middle",children:e.sub}),(0,a.jsx)(c,{x:e.x+55,y:120,type:e.icon,color:e.color})]})]},t)),(0,a.jsx)("rect",{x:"50",y:"160",width:"420",height:"70",rx:"8",fill:"#10b98106",stroke:"#10b981",strokeWidth:"1"}),(0,a.jsx)("text",{x:"260",y:"182",fill:"#6ee7b7",fontSize:"11",fontWeight:"700",textAnchor:"middle",children:"Decision Engine"}),[{x:70,label:"Score < 0.3",sub:"Ignore",color:"#10b981"},{x:210,label:"0.3 â 0.7",sub:"Auto-enrich",color:"#f59e0b"},{x:350,label:"Score > 0.7",sub:"Alert!",color:"#ef4444"}].map((e,t)=>(0,a.jsxs)("g",{children:[(0,a.jsx)("rect",{x:e.x,y:192,width:"120",height:"28",rx:"5",fill:"".concat(e.color,"15"),stroke:e.color,strokeWidth:"1"}),(0,a.jsx)("text",{x:e.x+60,y:205,fill:e.color,fontSize:"9",fontWeight:"700",textAnchor:"middle",children:e.label}),(0,a.jsx)("text",{x:e.x+60,y:216,fill:"".concat(e.color,"80"),fontSize:"7",textAnchor:"middle",children:e.sub})]},t))]})})}function h(){return(0,a.jsx)("div",{className:"my-8 flex justify-center",children:(0,a.jsxs)("svg",{viewBox:"0 0 520 260",className:"w-full max-w-xl",role:"img","aria-label":"Human in the Loop",children:[(0,a.jsx)("style",{children:"\n @keyframes hlPulse { 0%,100%{opacity:.6} 50%{opacity:1} }\n @keyframes hlFlow { 0%{stroke-dashoffset:12} 100%{stroke-dashoffset:0} }\n .hl-glow{animation:hlPulse 3s ease-in-out infinite}\n .hl-flow{stroke-width:1.5;stroke-dasharray:4 3;animation:hlFlow 2s linear infinite;fill:none}\n "}),(0,a.jsx)("defs",{children:(0,a.jsx)("marker",{id:"hlArr",viewBox:"0 0 10 10",refX:"9",refY:"5",markerWidth:"6",markerHeight:"6",orient:"auto-start-reverse",children:(0,a.jsx)("path",{d:"M0,0 L10,5 L0,10 z",fill:"#8b5cf6"})})}),(0,a.jsx)("rect",{x:"10",y:"10",width:"500",height:"240",rx:"16",fill:"#0f172a",stroke:"#1e293b",strokeWidth:"2"}),(0,a.jsx)("text",{x:"260",y:"38",fill:"#e2e8f0",fontSize:"14",fontWeight:"700",textAnchor:"middle",children:"Human-in-the-Loop Threat Response"}),(0,a.jsxs)("g",{className:"hl-glow",children:[(0,a.jsx)("rect",{x:"25",y:"55",width:"130",height:"75",rx:"10",fill:"#06b6d410",stroke:"#06b6d4",strokeWidth:"1.5"}),(0,a.jsx)(c,{x:90,y:78,type:"brain",color:"#22d3ee"}),(0,a.jsx)("text",{x:"90",y:"100",fill:"#22d3ee",fontSize:"10",fontWeight:"700",textAnchor:"middle",children:"AI Detects"}),(0,a.jsx)("text",{x:"90",y:"116",fill:"#22d3ee80",fontSize:"8",textAnchor:"middle",children:"Anomaly Score: 0.82"})]}
1),(0,a.jsx)("line",{x1:"155",y1:"92",x2:"188",y2:"92",stroke:"#475569",strokeWidth:"1.5",markerEnd:"url(#hlArr)"}),(0,a.jsxs)("g",{className:"hl-glow",style:{animationDelay:"0.3s"},children:[(0,a.jsx)("rect",{x:"190",y:"55",width:"140",height:"75",rx:"10",fill:"#f59e0b10",stroke:"#f59e0b",strokeWidth:"1.5"}),(0,a.jsx)(c,{x:260,y:78,type:"user",color:"#fbbf24"}),(0,a.jsx)("text",{x:"260",y:"100",fill:"#fbbf24",fontSize:"10",fontWeight:"700",textAnchor:"middle",children:"Analyst Reviews"}),(0,a.jsx)("text",{x:"260",y:"116",fill:"#fbbf2480",fontSize:"8",textAnchor:"middle",children:"Confirm or dismiss"})]}),(0,a.jsx)("line",{x1:"330",y1:"92",x2:"368",y2:"92",stroke:"#475569",strokeWidth:"1.5",markerEnd:"url(#hlArr)"}),(0,a.jsxs)("g",{className:"hl-glow",style:{animationDelay:"0.6s"},children:[(0,a.jsx)("rect",{x:"370",y:"55",width:"120",height:"75",rx:"10",fill:"#ef444410",stroke:"#ef4444",strokeWidth:"1.5"}),(0,a.jsx)(c,{x:430,y:78,type:"bolt",color:"#fca5a5"}),(0,a.jsx)("text",{x:"430",y:"100",fill:"#fca5a5",fontSize:"10",fontWeight:"700",textAnchor:"middle",children:"Respond"}),(0,a.jsx)("text",{x:"430",y:"116",fill:"#fca5a580",fontSize:"8",textAnchor:"middle",children:"Block / Isolate / Alert"})]}),(0,a.jsx)("path",{d:"M 430 130 Q 440 190 260 195 Q 80 190 90 168",className:"hl-flow",stroke:"#10b981",markerEnd:"url(#hlArr)"}),(0,a.jsx)("text",{x:"260",y:"210",fill:"#6ee7b7",fontSize:"9",fontWeight:"600",textAnchor:"middle",children:"Feedback Loop â Analyst decisions retrain the model"}),(0,a.jsx)("rect",{x:"80",y:"225",width:"360",height:"20",rx:"4",fill:"#8b5cf608",stroke:"#8b5cf6",strokeWidth:"0.5"}),(0,a.jsx)("text",{x:"260",y:"239",fill:"#c4b5fd",fontSize:"7",textAnchor:"middle",children:"Over time: false positive rate drops from 40% â 8% as model learns analyst patterns"})]})})}function m(){return(0,a.jsx)("div",{className:"my-8 flex justify-center",children:(0,a.jsxs)("svg",{viewBox:"0 0 500 240",className:"w-full max-w-lg",role:"img","aria-label":"Threat Intelligence",children:[(0,a.jsx)("style",{children:"\n @keyframes tiPulse { 0%,100%{opacity:.6} 50%{opacity:1} }\n .ti-glow{animation:tiPulse 3s ease-in-out infinite}\n "}),(0,a.jsx)("rect",{x:"10",y:"10",width:"480",height:"220",rx:"16",fill:"#0f172a",stroke:"#1e293b",strokeWidth:"2"}),(0,a.jsx)("text",{x:"250",y:"38",fill:"#e2e8f0",fontSize:"14",fontWeight:"700",textAnchor:"middle",children:"Threat Intelligence Enrichment"}),[{x:25,label:"IP Reputation",sub:"AbuseIPDB",color:"#ef4444",icon:"globe"},{x:135,label:"CVE Database",sub:"NVD / MITRE",color:"#f59e0b",icon:"list"},{x:245,label:"YARA Rules",sub:"Malware sigs",color:"#8b5cf6",icon:"search"},{x:355,label:"OSINT Feeds",sub:"Open threat data",color:"#06b6d4",icon:"antenna"}].map((e,t)=>(0,a.jsxs)("g",{className:"ti-glow",style:{animationDelay:"".concat(.2*t,"s")},children:[(0,a.jsx)("rect",{x:e.x,y:55,width:"105",height:"65",rx:"8",fill:"".concat(e.color,"10"),stroke:e.color,strokeWidth:"1.5"}),(0,a.jsx)("text",{x:e.x+52,y:76,fill:e.color,fontSize:"9",fontWeight:"700",textAnchor:"middle",children:e.label}),(0,a.jsx)("text",{x:e.x+52,y:92,fill:"".concat(e.color,"80"),fontSize:"7",textAnchor:"middle",children:e.sub}),(0,a.jsx)("text",{x:e.x+52,y:112,fill:"".concat(e.color,"60"),fontSize:"7",textAnchor:"middle",children:"Auto-queried"})]},t)),(0,a.jsxs)("g",{className:"ti-glow",style:{animationDelay:"0.8s"},children:[(0,a.jsx)("rect",{x:"120",y:"140",width:"260",height:"40",rx:"8",fill:"#10b98110",stroke:"#10b981",strokeWidth:"1.5"}),(0,a.jsx)(c,{x:145,y:160,type:"brain",color:"#6ee7b7"}),(0,a.jsx)("text",{x:"265",y:"163",fill:"#6ee7b7",fontSize:"11",fontWeight:"700",textAnchor:"middle",children:"Enrichment Engine"})]}),(0,a.jsx)("rect",{x:"90",y:"195",width:"320",height:"24",rx:"5",fill:"#f59e0b08",stroke:"#f59e0b",strokeWidth:"0.8"}),(0,a.jsx)("text",{x:"250",y:"211",fill:"#fbbf24",fontSize:"8",fontWeight:"600",textAnchor:"middle",children:'Result: "IP 45.33.32.156 â AbuseIPDB 95% confidence + known C2 server"'})]})})}function f(){return(0,a.jsx)("div",{className:"my-8 overflow-x-auto",children:(0,a.jsxs)("table",{className:"w-full border-collapse text-sm",children:[(0,a.jsx)("thead",{children:(0,a.jsxs)("tr",{className:"border-b-2 border-gray-200",children:[(0,a.jsx)("th",{className:"px-3 py-3 text-left font-bold text-gray-700",children:"Metric"}),(0,a.jsx)("th",{className:"px-3 py-3 text-left font-bold text-gray-600",children:"Description"}),(0,a.jsx)("th",{className:"px-3 py-3 text-center font-bold text-green-600",children:"Target"}),(0,a.jsx)("th",{className:"px-3 py-3 text-left font-bold text-amber-600",children:"Note"})]})}),(0,a.jsx)("tbody",{children:[{metric:"True Positive Rate",desc:"Real threats correctly detected",target:"> 95%",note:"Miss rate < 5%"},{metric:"False Positive Rate",desc:"Benign events flagged as threats",target:"< 5%",note:"Alert fatigue risk"},{metric:"Mean Time to Detect",desc:"Time from intrusion to detection",target:"< 10 min",note:"Pre-AI: hours/days"}
1,{metric:"Mean Time to Respond",desc:"Time from detection to response",target:"< 30 min",note:"Automated: seconds"},{metric:"Alert Volume",desc:"Alerts per analyst per day",target:"< 50",note:"> 100 = burnout"},{metric:"Model Drift",desc:"Detection accuracy degradation",target:"< 2% / month",note:"Retrain quarterly"}].map(e=>(0,a.jsxs)("tr",{className:"border-b border-gray-100 transition-colors hover:bg-gray-50",children:[(0,a.jsx)("td",{className:"px-3 py-2.5 font-semibold text-gray-800",children:e.metric}),(0,a.jsx)("td",{className:"px-3 py-2.5 text-gray-600",children:e.desc}),(0,a.jsx)("td",{className:"px-3 py-2.5 text-center font-bold text-green-600",children:e.target}),(0,a.jsx)("td",{className:"px-3 py-2.5 text-amber-600",children:e.note})]},e.metric))})]})})}function g(){return(0,a.jsx)("div",{className:"my-8 flex justify-center",children:(0,a.jsxs)("svg",{viewBox:"0 0 540 280",className:"w-full max-w-xl",role:"img","aria-label":"SIEM Architecture",children:[(0,a.jsx)("style",{children:"\n @keyframes siPulse { 0%,100%{opacity:.6} 50%{opacity:1} }\n @keyframes siFlow { 0%{stroke-dashoffset:12} 100%{stroke-dashoffset:0} }\n .si-glow{animation:siPulse 3s ease-in-out infinite}\n .si-flow{stroke-width:1;stroke-dasharray:4 3;animation:siFlow 2s linear infinite;fill:none}\n "}),(0,a.jsx)("defs",{children:(0,a.jsx)("marker",{id:"siArr",viewBox:"0 0 10 10",refX:"9",refY:"5",markerWidth:"6",markerHeight:"6",orient:"auto-start-reverse",children:(0,a.jsx)("path",{d:"M0,0 L10,5 L0,10 z",fill:"#06b6d4"})})}),(0,a.jsx)("rect",{x:"10",y:"10",width:"520",height:"260",rx:"16",fill:"#0f172a",stroke:"#1e293b",strokeWidth:"2"}),(0,a.jsx)("text",{x:"270",y:"38",fill:"#e2e8f0",fontSize:"14",fontWeight:"700",textAnchor:"middle",children:"AI-Enhanced SIEM Architecture"}),(0,a.jsx)("text",{x:"70",y:"60",fill:"#94a3b8",fontSize:"9",fontWeight:"600",textAnchor:"middle",children:"Log Sources"}),[{y:68,label:"Firewall Logs",color:"#3b82f6"},{y:93,label:"Auth Events",color:"#8b5cf6"},{y:118,label:"App Logs",color:"#06b6d4"},{y:143,label:"DNS Queries",color:"#10b981"},{y:168,label:"Endpoint Data",color:"#f59e0b"}].map((e,t)=>(0,a.jsxs)("g",{className:"si-glow",style:{animationDelay:"".concat(.15*t,"s")},children:[(0,a.jsx)("rect",{x:"20",y:e.y,width:"100",height:"20",rx:"4",fill:"".concat(e.color,"10"),stroke:e.color,strokeWidth:"0.8"}),(0,a.jsx)("text",{x:"70",y:e.y+14,fill:e.color,fontSize:"7",fontWeight:"600",textAnchor:"middle",children:e.label})]},t)),(0,a.jsxs)("g",{className:"si-glow",style:{animationDelay:"0.5s"},children:[(0,a.jsx)("rect",{x:"155",y:"65",width:"100",height:"130",rx:"8",fill:"#f5621010",stroke:"#f56210",strokeWidth:"1.5"}),(0,a.jsx)("text",{x:"205",y:"88",fill:"#f56210",fontSize:"9",fontWeight:"700",textAnchor:"middle",children:"Ingestion"}),(0,a.jsx)("text",{x:"205",y:"106",fill:"#f5621080",fontSize:"7",textAnchor:"middle",children:"Normalize"}),(0,a.jsx)("text",{x:"205",y:"122",fill:"#f5621080",fontSize:"7",textAnchor:"middle",children:"Parse"}),(0,a.jsx)("text",{x:"205",y:"138",fill:"#f5621080",fontSize:"7",textAnchor:"middle",children:"Enrich"}),(0,a.jsx)("text",{x:"205",y:"154",fill:"#f5621080",fontSize:"7",textAnchor:"middle",children:"Correlate"}),(0,a.jsx)(c,{x:205,y:176,type:"inbox",color:"#f56210"})]}),(0,a.jsxs)("g",{className:"si-glow",style:{animationDelay:"0.8s"},children:[(0,a.jsx)("rect",{x:"290",y:"65",width:"100",height:"130",rx:"8",fill:"#8b5cf610",stroke:"#8b5cf6",strokeWidth:"1.5"}),(0,a.jsx)("text",{x:"340",y:"88",fill:"#c4b5fd",fontSize:"9",fontWeight:"700",textAnchor:"middle",children:"AI Engine"}),(0,a.jsx)("text",{x:"340",y:"106",fill:"#c4b5fd80",fontSize:"7",textAnchor:"middle",children:"Rule matching"}),(0,a.jsx)("text",{x:"340",y:"122",fill:"#c4b5fd80",fontSize:"7",textAnchor:"middle",children:"ML anomaly det."}),(0,a.jsx)("text",{x:"340",y:"138",fill:"#c4b5fd80",fontSize:"7",textAnchor:"middle",children:"Threat scoring"}),(0,a.jsx)("text",{x:"340",y:"154",fill:"#c4b5fd80",fontSize:"7",textAnchor:"middle",children:"Kill chain map"}),(0,a.jsx)(c,{x:340,y:176,type:"brain",color:"#c4b5fd"})]}),(0,a.jsxs)("g",{className:"si-glow",style:{animationDelay:"1.1s"},children:[(0,a.jsx)("rect",{x:"425",y:"65",width:"90",height:"130",rx:"8",fill:"#10b98110",stroke:"#10b981",strokeWidth:"1.5"}),(0,a.jsx)("text",{x:"470",y:"88",fill:"#6ee7b7",fontSize:"9",fontWeight:"700",textAnchor:"middle",children:"Response"}),(0,a.jsx)("text",{x:"470",y:"106",fill:"#6ee7b780",fontSize:"7",textAnchor:"middle",children:"Dashboard"}),(0,a.jsx)("text",{x:"470",y:"122",fill:"#6ee7b780",fontSize:"7",textAnchor:"middle",children:"Alerts"}),(0,a.jsx)("text",{x:"470",y:"138",fill:"#6ee7b780",fontSize:"7",textAnchor:"middle",children:"SOAR playbook"}),(0,a.jsx)("text",{x:"470",y:"154",fill:"#6ee7b780",fontSize:"7",textAnchor:"middle",children:"Incident ticket"}),(0,a.jsx)(c,{x:470,y:176,type:"alert",color:"#6ee7b7"})]}),[120,255,390].map((e,t)=>(0,a.jsx)("line",{x1:e,y1:130,x2:e+30,y2:130,className:"si-flow",stroke:"#475569",markerEnd:"url(#siArr)"},t)),(0,a.jsx)("rect",{x:"155",y:"215",width:"235",height:"35",rx:"6",fill:"#06b6d408",stroke:"#06b6d4",strokeWidth:"1"}),(0,a.jsx)(c,{x:172,y:233,type:"disk",color:"#22d3ee"}),(0,a.jsx)("text",{x:"285",y:"233",fill:"#22d3ee",fontSize:"9",fontWeight:"600",textAnchor:"middle",children:"Hot (30d) â Warm (1y) â Cold Archive (7y)"}),(0,a.jsx)("text",{x:"272",y:"246",fill:"#22d3ee60",fontSize:"7",textAnchor:"middle",children:"Compliance: retain logs for audit and forensic investigation"})]})})}function y(e){let{locale:t}=e;return(0,a.jsxs)("article",{className:"mx-auto max-w-3xl px-6 py-16 lg:px-8",children:[(0,a.jsx)(o.g,{children:(0,a.jsxs)("div",{className:"prose-custom",children:[(0,a.jsxs)("p",{className:"text-xl font-light leading-relaxed text-gray-600",children:["Your security team is drowning. ",(0,a.jsx)("strong",{children:"10,000+ alerts per day"}),", and over 40% are false positives. Analysts spend more time dismissing noise than hunting real threats. Meanwhile, adversaries use AI-generated phishing, polymorphic malware, and living-off-the-land techniques that bypass every rule-based system you've deployed."]}),(0,a.jsxs)("p",{className:"mt-4 text-gray-600 leading-relaxed",children:["The answer isn't more rules. It's ",(0,a.jsx)("strong",{children:"AI that learns what ânormalâ looks like"})," and flags deviations â behavioral anomaly detection that catches zero-day attacks, insider threats, and credential abuse that signature-based tools miss entirely. Here's how to build it without a research team or a seven-figure budget."]})]})}),(0,a.jsx)(o.g,{children:(0,a.jsxs)("div",{className:"my-10 border-l-4 border-blue-500 bg-blue-50/50 py-4 pl-6 pr-4 rounded-r-xl",children:[(0,a.jsx)("p",{className:"text-gray-700 leading-relaxed italic",children:"âWe deployed anomaly detection on authentication logs for a manufacturing client. Within the first week, it caught a contractor account accessing engineering drawings at 3 AM from a foreign IP â something three years of firewall rules never flagged.â"}),(0,a.jsx)("p",{className:"mt-2 text-sm font-semibold text-blue-600",children:"â Sindika Security"})]})}),(0,a.jsxs)(o.g,{children:[(0,a.jsx)("h2",{className:"mb-4 mt-20 text-2xl font-bold text-gray-900",children:"Chapter 1: Why Rule-Based Security Fails"}),(0,a.jsxs)("p",{className:"text-gray-600 leading-relaxed",children:["Traditional security relies on ",(0,a.jsx)("strong",{children:"signatures and rules"}),": known malware hashes, known bad IPs, known attack patterns. This works against known threats. It fails completely against novel attacks."]})]}),(0,a.jsx)(o.g,{children:(0,a.jsxs)("div",{className:"my-8 rounded-2xl border border-amber-200 bg-amber-50 p-6",children:[(0,a.jsx)("h3",{className:"mb-3 text-base font-bold text-amber-800",children:"\uD83E\uDD14 The Limitations of Rule-Based Detection"}),(0,a.jsxs)("ul",{className:"space-y-2 text-sm text-amber-900/80",children:[(0,a.jsxs)("li",{className:"flex items-start gap-2",children:[(0,a.jsx)("span",{className:"mt-0.5 text-amber-500",children:"â¸"}),(0,a.jsxs)("span",{children:[(0,a.jsx)("strong",{children:"Zero-day blindness"})," â if the attack has never been seen before, there's no signature. Rule-based systems are reactive by definition â they detect yesterday's attacks."]})]}),(0,a.jsxs)("li",{className:"flex items-start gap-2",children:[(0,a.jsx)("span",{className:"mt-0.5 text-amber-500",children:"â¸"}),(0,a.jsxs)("span",{children:[(0,a.jsx)("strong",{children:"Rule explosion"})," â enterprise SIEM systems accumulate 5,000+ rules. Many conflict. Many are outdated. Nobody knows which ones are critical and which are noise generators."]})]}),(0,a.jsxs)("li",{className:"flex items-start gap-2",children:[(0,a.jsx)("span",{className:"mt-0.5 text-amber-500",children:"â¸"}),(0,a.jsxs)("span",{children:[(0,a.jsx)("strong",{children:"Evasion is trivial"})," â attackers slightly modify their tools to change the hash. A one-byte change defeats signature detection. AI-generated malware produces unique variants at scale."]})]}),(0,a.jsxs)("li",{className:"flex items-start gap-2",children:[(0,a.jsx)("span",{className:"mt-0.5 text-amber-500",children:"â¸"}),(0,a.jsxs)("span",{children:[(0,a.jsx)("strong",{children:"Insider threats are invisible"})," â rules detect external attacks. An employee slowly exfiltrating data over weeks uses legitimate credentials and legitimate tools. No rule fires."]})]}),(0,a.jsxs)("li",{className:"flex items-start gap-2",children:[(0,a.jsx)("span",{className:"mt-0.5 text-amber-500",children:"â¸"}),(0,a.jsxs)("span",{children:[(0,a.jsx)("strong",{children:"Alert fatigue kills teams"})," â 10,000 alerts/day with 40%+ false positive rate means analysts burn out, start ignoring alerts, and miss the real one buried on page 47."]})]})]})]})}),(0,a.jsx)(o.g,{children:(0,a.jsxs)("p",{className:"text-gray-600 leading-relaxed",children:["AI-powered detection doesn't replace rules â it ",(0,a.jsx)("strong",{children:"layers on top"}),". Rules catch the known 80%. ML models catch the unknown 20% that rules miss. Together, they form a detection system that's both precise and adaptive."]})}),(0,a.jsxs)(o.g,{children:[(0,a.jsx)("h2",{className:"mb-4 mt-20 text-2xl font-bold text-gray-900",children:"Chapter 2: Defense in Depth â Detection Layers"}),(0,a.jsxs)("p",{className:"text-gray-600 leading-relaxed",children:["Effective threat detection isn't a single tool â it's a ",(0,a.jsx)("strong",{children:"layered system"})," where each layer catches threats the previous one missed. AI enhances every layer, but it's most impactful at the behavioral analysis layer, where rules fundamentally can't operate."]})]}),(0,a.jsxs)(o.g,{children:[(0,a.jsx)(d,{}),(0,a.jsx)("p",{className:"mt-2 text-center text-xs text-gray-400 italic",children:"Five detection layers, from network perimeter to data access. AI is most powerful at Layer 3 (Behavioral Analysis) â detecting patterns no human could write rules for."})]}),(0,a.jsx)(o.g,{children:(0,a.jsxs)("div",{className:"my-8 rounded-2xl border border-green-200 bg-green-50 p-6",children:[(0,a.jsx)("h3",{className:"mb-3 text-base font-bold text-green-800",children:"â
What AI Adds to Each Layer"}),(0,a.jsxs)("ul",{className:"space-y-2 text-sm text-green-900/80",children:[(0,a.jsxs)("li",{className:"flex items-start gap-2",children:[(0,a.jsx)("span",{className:"mt-0.5 text-green-500",children:"â"}),(0,a.jsxs)("span",{children:[(0,a.jsx)("strong",{children:"Network"})," â ML models detect anomalous traffic patterns (unusual ports, protocols, data volumes) that static firewall rules can't anticipate."]})]}),(0,a.jsxs)("li",{className:"flex items-start gap-2",children:[(0,a.jsx)("span",{className:"mt-0.5 text-green-500",children:"â"}),(0,a.jsxs)("span",{children:[(0,a.jsx)("strong",{children:"Application"})," â NLP-based WAF rules detect obfuscated SQL injection and XSS that regex patterns miss. LLMs classify request payloads as benign or malicious."]})]}),(0,a.jsxs)("li",{className:"flex items-start gap-2",children:[(0,a.jsx)("span",{className:"mt-0.5 text-green-500",children:"â"}),(0,a.jsxs)("span",{children:[(0,a.jsx)("strong",{children:"Behavioral"})," â unsupervised learning baselines normal user behavior (login t
1imes, accessed resources, data volumes). Deviations trigger alerts without predefined rules."]})]}),(0,a.jsxs)("li",{className:"flex items-start gap-2",children:[(0,a.jsx)("span",{className:"mt-0.5 text-green-500",children:"â"}),(0,a.jsxs)("span",{children:[(0,a.jsx)("strong",{children:"Data"})," â classify data access patterns to detect bulk exfiltration, privilege escalation, and unusual query patterns across databases."]})]})]})]})}),(0,a.jsxs)(o.g,{children:[(0,a.jsx)("h2",{className:"mb-4 mt-20 text-2xl font-bold text-gray-900",children:"Chapter 3: How ML Anomaly Detection Works"}),(0,a.jsxs)("p",{className:"text-gray-600 leading-relaxed",children:["The core of AI-powered threat detection is ",(0,a.jsx)("strong",{children:"anomaly detection"})," â training models on what ânormalâ looks like, then scoring every event against that baseline. Events that deviate significantly are potential threats."]})]}),(0,a.jsx)(o.g,{children:(0,a.jsx)(x,{})}),(0,a.jsx)(o.g,{children:(0,a.jsxs)("p",{className:"mt-6 text-gray-600 leading-relaxed",children:["The preferred algorithm is ",(0,a.jsx)("strong",{children:"Isolation Forest"})," â an unsupervised model that requires no labeled attack data. It learns ânormalâ from 30+ days of historical behavior, then assigns an anomaly score (0.0 = normal, 1.0 = highly anomalous) to every new event."]})}),(0,a.jsx)(o.g,{children:(0,a.jsxs)("div",{className:"my-8 grid grid-cols-1 gap-3 sm:grid-cols-3",children:[(0,a.jsxs)("div",{className:"rounded-xl border border-blue-200 bg-blue-50/30 p-4",children:[(0,a.jsx)("h4",{className:"text-sm font-bold text-blue-800",children:"Temporal Features"}),(0,a.jsx)("p",{className:"mt-1.5 text-xs text-gray-600 leading-relaxed",children:"Hour of day, day of week, weekend flag, off-hours flag. A login at 9 AM is normal; the same login at 3 AM is suspicious."})]}),(0,a.jsxs)("div",{className:"rounded-xl border border-violet-200 bg-violet-50/30 p-4",children:[(0,a.jsx)("h4",{className:"text-sm font-bold text-violet-800",children:"Behavioral Features"}),(0,a.jsx)("p",{className:"mt-1.5 text-xs text-gray-600 leading-relaxed",children:"Login count in 24h, unique IPs, failed attempts, new device flag. 15 logins from 8 different countries in one hour is anomalous."})]}),(0,a.jsxs)("div",{className:"rounded-xl border border-cyan-200 bg-cyan-50/30 p-4",children:[(0,a.jsx)("h4",{className:"text-sm font-bold text-cyan-800",children:"Geographic Features"}),(0,a.jsx)("p",{className:"mt-1.5 text-xs text-gray-600 leading-relaxed",children:"Distance from usual location, new country flag, VPN/proxy detection. An âimpossible travelâ alert fires when a user logs in from two countries 20 minutes apart."})]})]})}),(0,a.jsx)(o.g,{children:(0,a.jsxs)("p",{className:"text-gray-600 leading-relaxed",children:["The feature engineering is as important as the model. Raw logs are useless to ML â you need to extract ",(0,a.jsx)("strong",{children:"behavioral signals"})," that capture the ",(0,a.jsx)("em",{children:"context"}),"making a normal login at 9 AM from the office fundamentally different from the same credentials used at 3 AM from another continent."]})}),(0,a.jsxs)(o.g,{children:[(0,a.jsx)("h2",{className:"mb-4 mt-20 text-2xl font-bold text-gray-900",children:"Chapter 4: AI-Enhanced SIEM Architecture"}),(0,a.jsxs)("p",{className:"text-gray-600 leading-relaxed",children:["A Security Information and Event Management (SIEM) system is the ",(0,a.jsx)("strong",{children:"central nervous system"})," of your security operations. It ingests logs from every source, normalizes them, correlates events across systems, and surfaces threats. Adding AI transforms it from a search engine into a detection engine."]})]}),(0,a.jsxs)(o.g,{children:[(0,a.jsx)(g,{}),(0,a.jsx)("p",{className:"mt-2 text-center text-xs text-gray-400 italic",children:"Logs flow through ingestion (normalize, parse, enrich) â AI engine (rules + ML + threat scoring) â response (dashboards, alerts, automated playbooks)."})]}),(0,a.jsx)(o.g,{children:(0,a.jsx)("div",{className:"my-8 grid grid-cols-1 gap-3 sm:grid-cols-2",children:[{name:"Wazuh",role:"Open-Source SIEM",desc:"Host-based intrusion detection, log analysis, file integrity monitoring. Free alternative to Splunk costing $150K+/year.",color:"blue"},{name:"Elasticsearch + Kibana",role:"Search & Visualization",desc:"Index billions of log events. Sub-second search across months of data. Kibana dashboards for security analysts.",color:"violet"},{name:"ML Detection Sidecar",role:"AI Layer",desc:"Custom anomaly detection service that c
1onsumes normalized events, scores them, and pushes high-confidence alerts to the response pipeline.",color:"cyan"},{name:"SOAR Playbooks",role:"Automated Response",desc:"Security Orchestration, Automation and Response. When a confirmed threat surfaces, SOAR automatically blocks IPs, disables accounts, and creates incident tickets.",color:"emerald"}].map(e=>(0,a.jsxs)("div",{className:"rounded-xl border border-".concat(e.color,"-200 bg-").concat(e.color,"-50/30 p-4"),children:[(0,a.jsx)("h4",{className:"text-sm font-bold text-gray-800",children:e.name}),(0,a.jsx)("p",{className:"mt-0.5 text-xs font-semibold text-gray-500",children:e.role}),(0,a.jsx)("p",{className:"mt-1.5 text-xs text-gray-600 leading-relaxed",children:e.desc})]},e.name))})}),(0,a.jsx)(o.g,{children:(0,a.jsxs)("p",{className:"text-gray-600 leading-relaxed",children:["Log retention follows a tiered strategy: ",(0,a.jsx)("strong",{children:"hot storage"})," (30 days, fast query), ",(0,a.jsx)("strong",{children:"warm storage"})," (1 year, compressed), and ",(0,a.jsx)("strong",{children:"cold archive"})," (7 years, compliance). This balances investigation speed with regulatory requirements and storage costs."]})}),(0,a.jsxs)(o.g,{children:[(0,a.jsx)("h2",{className:"mb-4 mt-20 text-2xl font-bold text-gray-900",children:"Chapter 5: Threat Intelligence Enrichment"}),(0,a.jsxs)("p",{className:"text-gray-600 leading-relaxed",children:["An anomaly score only tells you ",(0,a.jsx)("em",{children:"something is unusual"}),". Threat intelligence tells you ",(0,a.jsx)("em",{children:"why it matters"}),". Automatically enriching alerts with external intelligence â IP reputation, CVE databases, known command-and-control servers â transforms a âsuspicious login from 45.33.32.156â into âlogin from a",(0,a.jsx)("strong",{children:" known C2 server"})," with 95% confidence.â"]})]}),(0,a.jsx)(o.g,{children:(0,a.jsx)(m,{})}),(0,a.jsx)(o.g,{children:(0,a.jsx)("div",{className:"my-8 grid grid-cols-1 gap-3 sm:grid-cols-2",children:[{source:"AbuseIPDB",what:"IP reputation scores based on community reports. Instantly identifies known malicious IPs, scanners, and brute-force sources.",color:"red"},{source:"GreyNoise",what:"Distinguishes targeted attacks from background internet noise. Filters out mass scanners so analysts focus on real threats.",color:"amber"},{source:"NVD / MITRE ATT&CK",what:"Vulnerability databases and attack technique taxonomy. Maps detected behavior to known adversary tactics for context.",color:"violet"},{source:"YARA Rules",what:"Malware signature patterns. Detects known malware families in file uploads, email attachments, and network traffic.",color:"cyan"}].map(e=>(0,a.jsxs)("div",{className:"rounded-xl border border-".concat(e.color,"-200 bg-").concat(e.color,"-50/30 p-4"),children:[(0,a.jsx)("h4",{className:"text-sm font-bold text-gray-800",children:e.source}),(0,a.jsx)("p",{className:"mt-1.5 text-xs text-gray-600 leading-relaxed",children:e.what})]},e.source))})}),(0,a.jsx)(o.g,{children:(0,a.jsxs)("p",{className:"text-gray-600 leading-relaxed",children:["The enrichment engine queries all feeds ",(0,a.jsx)("strong",{children:"in parallel"})," the moment an anomaly is detected. By the time an analyst sees the alert, it already includes IP reputation, geographic data, user history, and correlated events. Manual investigation for initial triage becomes unnecessary â the context is pre-built."]})}),(0,a.jsxs)(o.g,{children:[(0,a.jsx)("h2",{className:"mb-4 mt-20 text-2xl font-bold text-gray-900",children:"Chapter 6: Human-in-the-Loop Response"}),(0,a.jsxs)("p",{className:"text-gray-600 leading-relaxed",children:["AI detects. Humans decide. Automating the ",(0,a.jsx)("em",{children:"detection"})," frees your security team to focus on ",(0,a.jsx)("em",{children:"investigation and response"}),". But the critical insight is the",(0,a.jsx)("strong",{children:" feedback loop"}),": every analyst decision (confirm or dismiss) retrains the model. Over months, false positives drop from 40% to under 8%."]})]}),(0,a.jsx)(o.g,{children:(0,a.jsx)(h,{})}),(0,a.jsx)(o.g,{children:(0,a.jsxs)("div",{className:"my-8 rounded-2xl border border-green-200 bg-green-50 p-6",children:[(0,a.jsx)("h3",{className:"mb-3 text-base font-bold text-green-800",children:"â
Building an Effective Feedback Loop"}),(0,a.jsxs)("ul",{className:"space-y-2 text-sm text-green-900/80",children:[(0,a.jsxs)("li",{className:"flex items-start gap-2",children:[(0,a.jsx)("span",{className:"mt-0.5 text-green-500",children:"â"}),(0,a.jsxs)("span",{children:[(0,a.jsx)("strong",{children:"One-click triage"})," â make it effortless for analysts to classify alerts: Real Threat, False Positive, or Needs Investigation. Three buttons, no forms, no context switching."]})]}),(0,a.jsxs)("li",{className:"flex items-start gap-2",children:[(0,a.jsx)("span",{className:"mt-0.5 text-green-500",children:"â"}),(0,a.jsxs)("span",{children:[(0,a.jsx)("strong",{children:"Auto-enrichment before review"})," â by the time an analyst sees the alert, it already includes IP reputation, geo data, user history, and related events. No manual investigation for triage."]})]}),(0,a.jsxs)("li",{className:"flex items-start gap-2",children:[(0,a.jsx)("span",{className:"mt-0.5 text-green-500",children:"â"}),(0,a.jsxs)("span",{children:[(0,a.jsx)("strong",{children:"Weekly model retraining"})," â confirmed false positives are fed back into training data. The model learns your organization's unique patterns (like the CEO who travels weekly or the dev team that deploys at midnight)."]})]}),(0,a.jsxs)("li",{className:"flex items-start gap-2",children:[(0,a.jsx)("span",{className:"mt-0.5 text-green-500",children:"â"}),(0,a.jsxs)("span",{children:[(0,a.jsx)("strong",{children:"Automated playbooks for c
1onfirmed threats"})," â block IP, disable account, isolate host, create incident ticket. Humans confirm the threat; SOAR executes the response. Response time drops from hours to seconds."]})]})]})]})}),(0,a.jsxs)(o.g,{children:[(0,a.jsx)("h2",{className:"mb-4 mt-20 text-2xl font-bold text-gray-900",children:"Chapter 7: Measuring Detection Effectiveness"}),(0,a.jsx)("p",{className:"text-gray-600 leading-relaxed",children:"âIs our threat detection working?â is a question most security teams can't answer with data. Here are the metrics that matter â and the targets that separate an effective SOC from security theater."})]}),(0,a.jsx)(o.g,{children:(0,a.jsxs)("div",{className:"rounded-2xl border border-gray-200 bg-white p-6 shadow-sm",children:[(0,a.jsx)("h3",{className:"mb-3 text-sm font-bold text-gray-700 uppercase tracking-wider",children:"SOC Performance Metrics"}),(0,a.jsx)(f,{})]})}),(0,a.jsx)(o.g,{children:(0,a.jsxs)("p",{className:"text-gray-600 leading-relaxed",children:["The most important metric is ",(0,a.jsx)("strong",{children:"Mean Time to Detect (MTTD)"}),". IBM's 2025 Cost of a Data Breach report found that breaches detected in under 200 days cost $1M less on average. AI-powered detection brings MTTD from",(0,a.jsx)("strong",{children:" days/weeks to minutes"}),". That's not an incremental improvement â it's a categorical shift in security posture."]})}),(0,a.jsx)(o.g,{children:(0,a.jsxs)("div",{className:"my-8 rounded-2xl border border-amber-200 bg-amber-50 p-6",children:[(0,a.jsx)("h3",{className:"mb-3 text-base font-bold text-amber-800",children:"\uD83E\uDD14 Common Detection Pitfalls"}),(0,a.jsxs)("ul",{className:"space-y-2 text-sm text-amber-900/80",children:[(0,a.jsxs)("li",{className:"flex items-start gap-2",children:[(0,a.jsx)("span",{className:"mt-0.5 text-amber-500",children:"â¸"}),(0,a.jsxs)("span",{children:[(0,a.jsx)("strong",{children:"Model drift"})," â your organization's ânormalâ changes over time. New employees, new offices, changed work hours. If you don't retrain, false positives spike. Schedule quarterly retraining at minimum."]})]}),(0,a.jsxs)("li",{className:"flex items-start gap-2",children:[(0,a.jsx)("span",{className:"mt-0.5 text-amber-500",children:"â¸"}),(0,a.jsxs)("span",{children:[(0,a.jsx)("strong",{children:"Adversarial evasion"})," â sophisticated attackers mimic normal behavior (low volume, business hours, legitimate tools). Layer multiple detection models â network + behavioral + data access â to catch what one model misses."]})]}),(0,a.jsxs)("li",{className:"flex items-start gap-2",children:[(0,a.jsx)("span",{className:"mt-0.5 text-amber-500",children:"â¸"}),(0,a.jsxs)("span",{children:[(0,a.jsx)("strong",{children:"Data quality"})," â garbage in, garbage out. If your log pipeline drops events or timestamps are inconsistent, the model learns the wrong patterns. Fix data quality before investing in ML."]})]})]})]})}),(0,a.jsxs)(o.g,{children:[(0,a.jsx)("h2",{className:"mb-4 mt-20 text-2xl font-bold text-gray-900",children:"Chapter 8: Practical Implementation Roadmap"}),(0,a.jsxs)("p",{className:"text-gray-600 leading-relaxed",children:["You don't need a team of PhDs to deploy AI threat detection. Start with the highest-value, lowest-complexity use case â ",(0,a.jsx)("strong",{children:"authentication anomalies"})," â and expand from there."]})]}),(0,a.jsx)(o.g,{children:(0,a.jsx)("div",{className:"my-8 space-y-4",children:[{phase:"Phase 1 (Week 1â2)",title:"Centralize Logs",items:["Deploy an open-source SIEM stack (Wazuh + ELK or Loki)","Ingest authentication, firewall, DNS, and application logs","Normalize timestamps and user identifiers across all sources","Verify data completeness â no dropped events, no gaps"],color:"blue"},{phase:"Phase 2 (Week 3â4)",title:"Baseline & Feature Engineering",items:["Collect 30+ days of normal behavior data as the training baseline","Build feature extraction pipeline (temporal, behavioral, geographic)","Train initial anomaly detection model on authentication events","Run in shadow mode â score every event but don't alert yet"],color:"violet"},{phase:"Phase 3 (Month 2)",title:"Detection & Enrichment",items:["Enable alerting with conservative thresholds (score > 0.8)","Integrate threat intelligence feeds (AbuseIPDB, GreyNoise)","Build analyst triage dashboard with one-click classification","Start the feedback loop â retrain weekly with analyst-labeled data"],color:"cyan"}
1,{phase:"Phase 4 (Month 3+)",title:"Automation & Expansion",items:["Deploy SOAR playbooks for confirmed threat types","Expand ML detection to network traffic and data access patterns","Lower alert threshold as false positive rate drops below 10%","Add adversary simulation (red team exercises) to validate detection coverage"],color:"emerald"}].map(e=>(0,a.jsxs)("div",{className:"rounded-xl border border-".concat(e.color,"-200 bg-").concat(e.color,"-50/30 p-5"),children:[(0,a.jsxs)("h3",{className:"mb-2 text-sm font-bold text-gray-800",children:[e.phase,": ",e.title]}),(0,a.jsx)("ul",{className:"space-y-1 text-xs text-gray-600",children:e.items.map((e,t)=>(0,a.jsxs)("li",{className:"flex items-start gap-2",children:[(0,a.jsx)("span",{className:"mt-0.5 text-gray-400",children:"â¸"}),(0,a.jsx)("span",{children:e})]},t))})]},e.phase))})}),(0,a.jsx)(o.g,{children:(0,a.jsxs)("div",{className:"my-10 border-l-4 border-blue-500 bg-blue-50/50 py-4 pl-6 pr-4 rounded-r-xl",children:[(0,a.jsx)("p",{className:"text-gray-700 leading-relaxed italic",children:"âStart small. Authentication anomaly detection alone catches credential abuse, brute force, and insider threats. That single model covers 60% of enterprise breach vectors. Perfect is the enemy of deployed.â"}),(0,a.jsx)("p",{className:"mt-2 text-sm font-semibold text-blue-600",children:"â Sindika Security"})]})}),(0,a.jsx)(o.g,{children:(0,a.jsxs)("div",{className:"my-16 rounded-2xl bg-gradient-to-br from-[#060d1b] via-[#0a1628] to-[#0c1527] p-8 text-center lg:p-12",children:[(0,a.jsx)("h2",{className:"mb-4 text-2xl font-bold text-white lg:text-3xl",children:"The Bottom Line"}),(0,a.jsxs)("p",{className:"mx-auto mb-6 max-w-xl text-gray-400 leading-relaxed",children:["AI-powered threat detection isn't about replacing your security team â it's about ",(0,a.jsx)("strong",{className:"text-white",children:"making them superhuman"}),". Anomaly detection catches what rules miss. Threat intelligence enrichment provides instant context. Automated playbooks respond in seconds."]}),(0,a.jsxs)("p",{className:"mx-auto max-w-xl text-sm text-gray-500",children:["The result: fewer false positives, faster detection, contained blast radius, and a security team that hunts threats instead of drowning in alerts.",(0,a.jsx)("strong",{className:"text-gray-400",children:" That's not the future of security â it's the present."})]}),(0,a.jsx)("div",{className:"mt-8",children:(0,a.jsxs)(l(),{href:"/".concat(t,"/contact"),className:"group inline-flex items-center gap-2 rounded-full bg-gradient-to-r from-blue-600 to-violet-600 px-8 py-4 font-semibold text-white shadow-lg transition-all duration-300 hover:shadow-blue-500/25 hover:shadow-2xl hover:scale-[1.02]",children:["Let's Secure Your Enterprise",(0,a.jsx)(r.A,{className:"h-4 w-4 transition-transform group-hover:translate-x-1"})]})})]})}),(0,a.jsx)("div",{className:"text-center",children:(0,a.jsxs)(l(),{href:"/".concat(t,"/blog"),className:"inline-flex items-center gap-2 text-sm font-medium text-blue-600 transition-colors hover:text-blue-800",children:[(0,a.jsx)(n.A,{className:"h-4 w-4"}),"Back to all articles"]})})]})}s(12115)}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.