TraceHawk — evidence-first security log investigation

01 · Project overview

From raw telemetry to auditable investigation

Security demos often stop at a list of alerts. I designed TraceHawk around the investigation chain: where an alert came from, which raw lines support it, why findings were correlated, what confidence can be justified, and what can be exported for review.

02 · Complete downloadable product

What TraceHawk actually does after you download it

The GitHub repository builds a complete self-hosted investigation application, not just the anonymous Azure demo. The protected profile runs the React workspace and FastAPI API together, persists bounded investigation state in SQLite, and enables workflows that are intentionally removed from the public deployment.

03 · Investigation workflow

A case remains connected to its evidence

The interface is structured around a repeatable sequence: load bounded evidence, inspect deterministic findings, review correlation rationale, pivot through entities and raw lines, and produce a report.

Media note: the first four captures and animated walkthrough preserve the v0.9.0 private-workspace interface. The public-demo captures below were recorded from the live v0.10.0 Azure deployment on 14 July 2026.

04 · Protected analyst workspace

One analysis state, eleven focused working surfaces

The full React application keeps the active analysis, selected incident and finding, assistant output, report format, live snapshot, rule selection, search query, and authentication state coordinated. Each view is a projection of the same evidence graph; the browser never invents findings locally.

State boundary: the protected workspace can reopen persisted investigations and notes. The public demo cannot. The public browser result disappears on refresh, close, inactivity expiry, or Clear session.

05 · Public demo investigations

Three fixed samples expose different parser and detection paths

I ran every sample in the live public deployment and inspected the incident, finding, evidence, entity, MITRE, report, and search views. These are observed results from sanitized fixtures, not production accuracy benchmarks.

06 · Public learning surfaces

The public demo is more than an upload form

The v0.10.0 interface exposes nine connected surfaces. Global search can narrow the current analysis by technique, entity, rule, or evidence text without changing the underlying result.

07 · Architecture

Deterministic authority with an optional AI boundary

Findings are produced only by deterministic detection code. Optional local Ollama explanations receive a bounded projection of already selected evidence and cannot create, alter, or score findings.

Core invariant: AI is outside the detection authority. Raw input, parser provenance, rules, evidence IDs, MITRE mappings, correlation, and incident scores are deterministic. A local Ollama model can only explain a bounded projection after those results exist.

08 · Ingest and parser routing

Specific security formats outrank generic fallbacks

TraceHawk does not infer a parser from a filename or first line alone. It samples non-empty input across the file, ranks parser specificity, suppresses weak generic matches, supports mixed inputs, and preserves _tracehawk_parser provenance on normalized events.

09 · Multi-source cases and live inputs

The downloaded application can investigate more than static uploads

The protected profile supports two wider workflows: combining exported telemetry from multiple engines into one case, and observing bounded local sources through WebSockets or the optional syslog collector. Both paths reuse the same parsing, rules, correlation, evidence-integrity, and persistence services.

The repository documents these as the expected result of its committed real-lab Zeek/Suricata case contract. They are fixture results, not production traffic metrics.

Current community-export defect found during this review: the v0.10.0 image contains the Real lab case action, but its referenced proof-pack files are not included in the public export, so that convenience action returns “Real lab proof pack was not found.” Manual case upload and the case-bundle API remain implemented and tested; the shortcut should be repaired in the next release.

10 · Security boundaries and authorization

The public demo and protected workspace have different trust contracts

I do not expose the protected analyst workspace as the public portfolio demo. The anonymous deployment removes persistence and privileged capabilities. The downloaded application can run loopback-only with local admin access or behind a trusted Azure Easy Auth-compatible identity proxy with viewer, analyst, and admin roles.

Anonymous public-demo contract

Safe use: do not upload credentials, client data, private topology, production logs, internal hostnames, or real incident evidence to the public demo.

Protected workspace role model

11 · Persistence, retention, and operations

Saved evidence has an explicit lifecycle

The downloaded application does not retain the original uploaded file, but it does persist the raw line text needed to reopen evidence and explain saved findings. That distinction matters: local-first does not mean non-sensitive, and report redaction does not alter stored evidence.

12 · Repository and release evidence

The public repository is part of the case study

The GitHub release is not a source dump without context. It is a curated MIT-licensed community export with runnable code, tests, documentation, sanitized proof assets, dependency manifests, and an export receipt tied to a clean source state.

• Generated OpenAPI and TypeScript contracts fail the build when backend and frontend schemas drift.
• GitHub Actions covers tests, builds, dependency audits, Gitleaks, Semgrep, container scanning, scenario contracts, and public-demo verification.
• Architecture decisions document parser routing, evidence identity, deterministic correlation, and the local-LLM boundary.
• Release assets include the export receipt, current IoT-23 evaluation, SBOMs, demo media, and sample incident reports.

13 · Verification evidence

Claims are tied to executable gates

The figures below reflect the current v0.10.0 verification baseline. They are evidence of tested behavior, not a claim of production-scale SOC readiness.

• All 66 rules have positive contracts; committed scenarios reported no unexpected or missing findings.
• The live Azure verifier confirmed database-disabled public mode, external AI disabled, private API denial, and eight tutorial chapters.
• CI also covers container build, dependency audits, secret scanning, static analysis, browser workflows, and public exact-commit verification.
• The complete gate is reproducible from the source repository with make verify-all.

14 · Detection quality

External data exposes weaknesses that fixtures cannot

I evaluated selected rule families against role-separated IoT-23 captures. The results are intentionally published with false positives and false negatives because a security project is not credible if only successful fixtures are shown.

Interpretation: the C2 indicator is too noisy for production authority in its current form. The evaluation proves the measurement process and identifies tuning work; it does not prove mature detection accuracy.

15 · Runtime AI boundary and development disclosure

AI can explain evidence; it cannot become detection authority

TraceHawk has two distinct AI stories. Inside the product, optional local AI explains an already-created deterministic incident. During development, generative AI produced most implementation drafts. Both boundaries are public and independently limited.

How the implementation was produced

I estimate that approximately 99% of the implementation code was initially generated or drafted with generative AI assistance. I do not present that code volume as proof of personal authorship by manual typing.

The evidence standard: a certificate can support the claim that I understand principles, while a project demonstrates application. Tests, architecture explanations, limitations, and an explicit AI-use record make it possible to evaluate what I actually learned and can defend.

Complete prompt histories were not retained, so the estimated generated-code share is disclosed but is not independently auditable line by line.

16 · Certification context

Certification and project evidence reinforce each other

I completed Microsoft Certified: Azure Fundamentals (AZ-900). TraceHawk adds practical evidence around Azure delivery, deployment boundaries, containerized services, security controls, CI validation, and operational ownership.

This Microsoft Learn link includes my Microsoft Student Ambassadors Contributor ID. The portfolio, demo, and GitHub links do not use Microsoft tracking parameters because they are not Microsoft Learn destinations.

17 · Limits and next steps

Current boundaries are explicit