Risk & Cybersecurity
Live demoCyber Narrative Radar
Full-stack early-warning system that turns public cyber discourse into explainable alerts, organization drilldowns, and narrative clusters for analyst workflows.
Role: Sole builder (end-to-end product)
Executive summary
- Decision
- Can public cyber chatter become an alert a skeptic can inspect, rather than a black-box summary?
- Answer
- Yes, if scoring stays deterministic, evidence posts sit next to the flag, and org / narrative views remain queryable.
- Shipped
- Sole-built local-first MVP: ETL, relational schema, FastAPI, React dashboard, Docker / Render deploy path, and a public walkthrough demo.
- Limits
- Sources are public RSS, Reddit, and seed / synthetic text. This is not a production SOC feed. Detection does not depend on an opaque LLM.
Visual evidence
Embedded preview of the working product. The iframe stays off until you load it. Open full-screen for the complete walkthrough.
The live demo is a third-party site. It is not loaded until you ask, so this page stays fast and private by default.
Situation
Security and risk teams need early signals from public chatter about ransomware, phishing, zero-days, and supply-chain issues- but black-box AI summaries without evidence are hard to trust in analyst settings.
Decision question
Can public cyber chatter be turned into explainable alerts that an analyst can defend, rather than a black-box summary?
Data and constraints
Public and synthetic cyber text (RSS, Reddit, seed data); scoring is deterministic and evidence-linked, not an opaque LLM-only detector.
Architecture
Public chatter is stored as inspectable records, then scored and clustered with methods an analyst can explain. The diagram matches the shipped MVP: RSS, Reddit, and seed data; local-first ETL; PostgreSQL; deterministic scoring and TF-IDF / KMeans; FastAPI; React dashboard.
01
Public sources
RSS, Reddit, and seed / synthetic cyber text.
02
Ingest and normalize
Local-first ETL turns unstructured posts into consistent records.
03
Relational store
PostgreSQL via SQLAlchemy keeps posts, orgs, and alerts inspectable.
04
Map
Content is mapped to organizations and narrative categories.
05
Detect
Deterministic scoring plus TF-IDF / KMeans clustering; evidence stays attached.
06
FastAPI
The API serves alerts, org drilldowns, and narrative clusters.
07
React dashboard
Analyst views: evidence-backed alerts, organization drilldowns, narrative explorer.
Method
Built a local-first MVP that ingests public/synthetic cyber text (RSS, Reddit, seed data), normalizes records, maps content to organizations and narrative categories, detects unusual activity with deterministic scoring and clustering, and presents evidence-backed alerts in a React dashboard. The deployed web app is available for live walkthroughs of alerts, organization drilldowns, and narrative clusters.
Narrative to structured data
One illustrative post, walked through the same path as the product: ingest public text, normalize it against a watchlist and narrative category, then attach a deterministic score and the evidence excerpt an analyst would inspect.
- Source
- rss
- Published
- 2026-03-04T14:22:00Z
- Type
- RawNarrativePost
Phishing lures impersonate a billing portal used by Harbor Grid contractors
A public security blog notes overlapping phishing emails that copy a contractor billing portal used by Harbor Grid Utilities. The posts urge staff to reset passwords on a lookalike domain. No confirmed credential theft is cited. The write-up links three similar reports from the same week.
Illustrative mock data. Not a live feed, not production telemetry, and not a claim about current demo contents.
Typed mock dataset
Schema used on this page. Field names follow the product idea in the case study: source text, org / category mapping, deterministic alerts with evidence, and TF-IDF / KMeans clusters with rule-based summaries.
RawNarrativePost
id, source (rss | reddit | synthetic), publishedAt, title, body
NormalizedRecord
postId, organization, sector, narrativeCategory, evidenceExcerpt
ExplainableAlert
alertId, severity, score (0-100, deterministic), whyFlagged[], evidencePostIds[]
NarrativeCluster
clusterId, title, method (TF-IDF / KMeans), summaryMethod (rule-based), postCount
| Post | Source | Organization | Category | Alert |
|---|---|---|---|---|
| Phishing lures impersonate a billing portal used by Harbor Grid contractors | rss | Harbor Grid Utilities | phishing | high, score 72 |
| Leak-site chatter names a logistics vendor; no proof of access | Northwind Payments | ransomware | watch, score 41 | |
| Seed chatter: supply-chain advisory discussing a library used by Atlas Components | synthetic | Atlas Components | supply-chain | No alert (seed only) |
NarrativeCluster / TF-IDF / KMeans
Contractor billing-portal impersonation
Rule-based cluster summary: public posts discuss lookalike billing-portal lures aimed at a utilities contractor. No confirmed credential theft in the illustrative sample. Analyst action is to inspect evidence posts, not to treat the cluster title as proof of compromise.
postCount 3 / summary rule-based / orgs Harbor Grid Utilities
Tools
- Python
- FastAPI
- SQLAlchemy
- PostgreSQL
- Docker
- React
- TypeScript
- TF-IDF / KMeans clustering
Deliverables
- Live deployed analyst dashboard
- Relational schema and ETL pipeline
- Explainable alert scoring with evidence posts
- Organization and narrative explorer views
- Deployment documentation (Docker / Render / Railway path)
Outcome / decision value
- Shipped a portfolio-grade, documented platform demonstrating OSINT-style cyber narrative intelligence with explainable methods rather than opaque LLM-only detection.
- Public demo deployed at cyber-narrative-radar-web.onrender.com for recruiter and hiring-manager walkthroughs.
Lessons learned
- Evidence posts next to an alert matter more than a higher unexplained score.
- Local-first ETL plus a relational schema keeps narrative intelligence inspectable.