Clair Obscur — Théo ELOY

Context: Hackathon — Commissariat du Numérique de Défense (French Defense Digital Agency)

Result: 🥈 2nd place overall · 🥇 1st place for attack detection quality (accuracy and relevance of generated alerts)

Overview

Clair Obscur is a SIEM-style NDR (Network Detection and Response) platform designed to assist SOC analysts through an LLM-based analysis engine capable of detecting, contextualizing, and explaining cyberattacks from raw logs.

Functional diagram of the pipeline, from log collection to result delivery to the analyst

The problem we addressed

SOC analysts face a massive volume of logs and alerts that are often poorly contextualized, slowing down the detection of real threats and the reconstruction of attack chains (kill chains). Clair Obscur aims to reduce this cognitive load by automating analysis and providing actionable summaries directly usable by analysts.

What we built

Real-time NDR platform

Designed a SIEM-style application for visualizing firewall logs, alerts, analytics, and security KPIs, with a React frontend and a FastAPI backend.

Cloud pipeline & ingestion

Set up an AWS architecture (OpenSearch, S3, SQS, Lambda, SageMaker, EC2, CloudWatch) ensuring continuous ingestion, storage, orchestration, and observability of data. The architecture was also adapted for an on-premise deployment using ClickHouse and PostgreSQL.

AWS architecture diagram: Lambda/SQS ingestion, S3 storage, SageMaker and Claude models, FastAPI backend and frontend

AI-driven attack analysis engine

Developed an LLM-based engine with regex pre-processing to extract, normalize, and structure key incident information. The LLM, configured with a senior analyst role, leverages statistics computed on log batches (based on the MITRE ATT&CK and MITRE D3FEND frameworks) to reconstruct attack kill chains.

AI assistant for the SOC

Designed an agentic assistant capable of answering analysts’ questions, generating incident summaries, and producing targeted analyses of specific alerts.

Tech stack

Frontend: React
Backend: FastAPI
Cloud: AWS (OpenSearch, S3, SQS, Lambda, SageMaker, EC2, CloudWatch)
On-premise: ClickHouse, PostgreSQL
AI: LLM (analyst agent), Claude API

Skills involved

Distributed cloud architecture, data engineering, full-stack development, orchestration pipeline design, prompt engineering, agentic frameworks, threat intelligence (MITRE ATT&CK/D3FEND), and product design for business users (SOC analysts).

Outcome

Out of 10 competing teams, Clair Obscur ranked 2nd overall, and 1st on the specific criterion of detection quality: the accuracy and relevance of alerts generated by the AI analysis engine.