Open-source project
AuraSpear Platform
An AI-first, multi-tenant SOC platform unifying SIEM, SOAR and threat intelligence in one investigation workspace.
Overview
AuraSpear brings alerts, cases, incidents, hunts, intelligence enrichment and detection engineering into a single governed workspace. It is built for teams that serve several tenants at once, where one customer's data must never be reachable from another's session.
Architecture
Next.js and NestJS over PostgreSQL with Prisma, Redis for caching, and OpenSearch for log search at volume. Wazuh and MISP feed detections and threat intelligence, and AWS Bedrock backs the AI reasoning. Tenant isolation is enforced in the data layer rather than the UI, and every connector credential is handled server-side.
Engineering
The core work was making multi-tenancy and RBAC unavoidable rather than optional — scoping every query, every job and every AI call to a tenant. On top of that sits alert triage, case management, threat hunting, intelligence enrichment, and AI assistance woven into the investigation rather than bolted on beside it.
- Role
- Designed and implemented the platform: tenant isolation model, RBAC, investigation workflows and AI-assisted analysis.
- Category
- Security
- Stack
- Next.jsNestJSTypeScriptPrismaPostgreSQLRedisOpenSearchWazuhMISPAWS BedrockDocker
- Language
- TypeScript