Row 05 of 07

Threat investigation

Area: Product
Level: Engineer
Result: 37% of 64K lines
Stack: React · TypeScript · Process trees · Query builder · Data visualisation

Led the frontend of the module analysts use to investigate threats: process trees, alert triage and a visual query builder.

24 of 6464 cells, one per thousand lines of the module. The filled ones are about my share, 37%.

Context

When an alert fires, an analyst has to work out what ran, what it started and what else it touched, across very large datasets. The threat investigation module is where they do that.

What I did

Inside a cross-functional team, I led the frontend. I built the interactive process-tree views, the alert triage screens, and a visual query builder that lets analysts search large datasets without writing a query.

I drove the memory work on complex trees, and led incident response when production broke.

Outcome

I wrote 37% of the module’s 64,000 lines. After a demo to a Gartner analyst, I turned their feedback into shipped product changes.