Sorry, unable to follow Crystal. Please try again.
I worked on improving the webapp I built during my Summer 2020 internship. The application was picked up by IBM's Incident Response team to use as an internal tool. I've helped decrease the manual lookup and classification performed by security analysts by integrating an automatic feedback loop to retrain the technique classifier with new training data and ATT&CK techniques and offering additional features for user customization (i.e., customization of the order of report results, acceptance of PDF report files). I also assisted a development team with the release of a new product by implementing Python scripts that standardize the format of incoming Structured Threat Information Expression data and automates the process of updating data to the Cloudant databases. Lastly, I individually worked on a confidential proof of concept project with Node.js. Generally, this project is a webapp that integrates Kafka to process real-time events and displays them visually and audibly.
I was a Backend Developer Intern under the Security business unit and contributed to two projects. The main project that I worked on was building a webapp to automate the analysis of cyber threat intelligence reports. This application reads in a threat intelligence report and parses the article into sentences. Then, the relevant sentences are mapped to one of three hundred (and growing) known MITRE ATT&CK techniques using natural language processing. The webapp was built using Python, JavaScript, HTML, CSS, Docker, and PostgreSQL. For the second project, I contributed to the open source Sigma project by developing the Structured Threat Intelligence Expression backend. I was responsible for translating security log files from Sigma rules to STIX patterns.