Unified Threat Intelligence Dashboard — 8-Gate Conviction Engine + Role Catalog

SOC teams typically juggle four consoles: one for ML detections, one for threat feeds, one for SIEM, one for mitigation. RoutePulse’s Unified Threat Intelligence Dashboard collapses them into a single 5-tab interface backed by Conviction Engine v2 (SPRT + Thompson Sampling + Conformal Prediction) and the Role Catalog (v4.28+) — a catalog-driven ML primitive that binds 39 service roles to behavioural context, replacing the legacy ml_role pipe-string with a typed, queryable, GIN-indexed schema.

Threat verdicts are no longer a single threshold. Every blackhole-bound decision walks through the 8-Gate Blackhole Pipeline: SPRT evidence accumulation → Thompson posterior sample → Conformal p-value (FDR ≤ 5 %) → Role-Catalog scope check → Cloud-ASN guard → Research-scanner exclusion → Peer-active sanity → Claude AI Gate 8 narrative review. Behind the dashboard live 39 threat feeds, 52,000+ Bloom-filter indicators with sub-microsecond lookup against every flow, MISP integration (4,894 events / 9.5 M attributes from soc.goline.ch), bidirectional Wazuh SIEM (295 agents), and 37 named detection rules spanning volumetric DDoS, SYN flood, amplification, port scanning, DNS tunnelling, slowloris.

Conviction Engine v2 — provable false-positive bounds

First BGP+security platform with a rigorous statistical guarantee on FP rate. SPRT accumulates log-likelihood evidence until it crosses an operator-tuned confidence boundary — faster decisions when evidence is strong, more samples when ambiguous. Thompson Sampling maintains a Beta(α,β) posterior per playbook action and updates from operator TP/FP feedback — learns which mitigations work. Conformal Prediction wraps the final score with a calibrated p-value, giving the blackhole decision an explicit upper bound on false-positive rate (FDR ≤ 5 % production setting). All three live in conviction-engine.ts with full WORM audit trail.

Role Catalog (v4.28+) — catalog-driven ML primitives

service-role-catalog.ts binds 39 explicit service roles (DNS recursor, mail submission, web server, VPN concentrator, NTP, etc.) to behavioural context. Every host carries hosts.role_tags (text[] + GIN index) plus the legacy ml_role kept in sync. Detectors look up role context before scoring — a DNS recursor producing outbound port-53 floods is normal; a web server producing the same is exfiltration. SNMP ifAlias inference (16 regex patterns) suggests roles from operator-maintained interface descriptions; the Pending Review tab lets operators confirm or override with top-5 confidence ranking.

5-tab unified SOC view

Overview: 10 KPI cards, 24 h threat timeline, live scoreboard by severity, TI hub. Detection: 3-stage pipeline (Stage 1 fast rules <1 ms, Stage 2 statistical EMA/Z-score/CUSUM/Shannon entropy 10–50 ms, Stage 3 AI classification). Feeds: MISP (4,894 events, 9.5 M attributes), Wazuh (295 agents), feed status, indicator search. Events: distribution charts, live feed, expandable rows, category detail panels. Scoring: 5-pillar Unified Threat Score with per-host gauges and pipeline summaries showing the SPRT / Thompson / Conformal contribution.

Key Capabilities

• Conviction Engine v2: SPRT + Thompson Sampling + Conformal Prediction with FDR ≤ 5 % provable false-positive bound (conviction-engine.ts)
• 8-Gate Blackhole Pipeline: SPRT → Thompson → Conformal → Role Scope → Cloud-ASN Guard → Scanner Exclusion → Peer Sanity → Claude AI Gate 8
• Role Catalog v4.28+: 39 service roles bound to behavioural context (service-role-catalog.ts); GIN-indexed hosts.role_tags replaces legacy ml_role pipe-string
• SNMP ifAlias role inference: 16 regex patterns suggest top-5 candidates; one-click apply in Pending Review tab
• 5-tab dashboard: Overview / Detection / Feeds / Events / Scoring — single pane replacing 4 legacy consoles
• 3-stage detection pipeline: fast rules <1 ms, statistical (EMA/Z-score/CUSUM/Shannon entropy) 10–50 ms, AI classification
• 39 built-in threat feeds: Spamhaus DROP/DROPv6/ASN-DROP, Feodo, ThreatFox, URLhaus, FireHOL L1/L2, IPsum, ET Compromised, CISA KEV, +30 more
• 52,000+ TI indicators in Bloom filter with sub-microsecond lookup against every flow
• Bidirectional MISP integration (4,894 events / 9.5 M attributes from soc.goline.ch)
• Wazuh SIEM bidirectional: syslog export + OpenSearch alert import (295 agents)
• 37 named detection rules (volumetric DDoS, SYN flood, amplification, port scan, DNS tunnel, slowloris)
• Temporal decay 7-day half-life, multi-feed consensus boost, campaign fingerprinting (5+ IPs same ASN/feed in 1 h)
• Context-aware severity: outbound C2 = CRITICAL; inbound scanner = WARNING; severity gated on AS202032 / own prefix involvement
• WORM audit chain: every gate fire, blackhole decision, threshold change appended with SHA-256 hash chain (NIS2/DORA replayable)

Engineered and operated by the GOLINE SOC & Network Engineering team.

Explore all RoutePulse features →