Security EngineeringLive2025

Cyber Attack Monitoring Dashboard

Real-time threat intelligence and investigation toolkit for security analysts.

Full-Stack Developer & Security Researcher Timeline: 2025

Designed a threat-intelligence and investigation workspace for security analysts.

client API keys

Credentials stay behind server-side route proxies.

core lookup types

IP, domain, and CVE workflows share one investigation surface.

security controls

Headers, validation, caching, safe links, and protected configuration.

01 / Project evidence

Project visual and links

Cyber Attack Monitoring Dashboard showing threat feed and risk scores — Product screenshot
Threat feed workspace
Product screenshot showing live indicators, risk scores, and investigation shortcuts in one analyst view.

02 / System design

Architecture diagram

A server-mediated lookup flow keeps third-party credentials away from the browser while the client focuses on investigation and visualization.

Threat lookup request path

The dashboard sends lookups through server routes so provider credentials are not shipped to the analyst’s browser.

STEP 01

Dashboard UI

Analyst

Enters an IP address, domain, or CVE identifier.

STEP 02

TanStack Query

Client data layer

Tracks loading/error state and reuses cached results.

STEP 03

Next.js API route

Server route

Validates the lookup and selects the relevant provider.

Browser → server trust boundary

STEP 04

AbuseIPDB / CIRCL CVE

Threat data

Returns the supported reputation or vulnerability information.

External intelligence providers

STEP 05

Risk panels + Recharts

Investigation view

Presents lookup results and context to the analyst.

Analyst follow-up links

External investigation tools are opened as user-initiated links rather than silently queried from the app.

STEP 01

IP / domain / CVE

Result context

The analyst chooses a result to investigate further.

STEP 02

VirusTotal / OTX / Shodan

External reference

Opens the selected provider’s public investigation page.

Navigation leaves this application

Arrows show the main request or data handoff. Boundary labels mark local-only processing, browser-to-server transitions, or external services.

03 / Engineering decisions

Choices and trade-offs

Decision 01

Proxy provider requests on the server

Choice: Keep API credentials in server-side routes and return only the response needed by the UI.

Trade-off: This reduces browser exposure of credentials, while adding a server hop and dependence on provider quotas and availability.

Decision 02

Separate lookup state from presentation

Choice: Use TanStack Query for request/cache state and Recharts for visual summaries.

Trade-off: The interface can reuse results and show data clearly, but provider response quality still limits the investigation.

Evidence

Evidence snapshot

Public verification snapshot from the production review. Values describe controls and scope, not private targets.

Client-side secretsNo API keys shippedIMPLEMENTED

Lookup surfacesIP · domain · CVEDOCUMENTED

Security headersEnabled at deployment edgeIMPLEMENTED

DeploymentVercel · liveDOCUMENTED

SCOPE: public dashboard controls
RESULT: secrets remain server-side
NOTE: target identifiers and provider response bodies removed

The listed lookup types, providers, and client/server boundaries describe the implemented dashboard. No claim of analyst time saved or detection accuracy is made.

05 / Verification

Verification methodology

Threat-model the browser boundary

Mapped every external lookup and marked credentials, user input, and provider responses as separate trust boundaries.

Exercise the lookup routes

Tested valid, malformed, empty, and provider-error inputs before wiring results into the UI.

Review deployment controls

Checked headers, client bundles, outbound links, responsive states, and loading/error behavior on the deployed build.

06 / Ownership

What I personally contributed

This section separates my direct contribution from broader project outcomes.

Owned the product direction, threat model, and end-to-end implementation.
Designed the route-proxy boundary and integrated the threat-intelligence providers.
Built the analyst UI, charts, loading states, error states, and responsive behavior.
Configured deployment, security headers, analytics, and the public documentation.

View source More projects