SOC analysts spend too much time switching between alerts, evidence and investigation tools.
AI Workspace • ProJECT Operations • 5 Weeks • solo desighner
Overview
Designed a unified investigation workspace that helps SOC analysts analyze alerts, connect evidence, and respond to security incidents from a single workflow.
The Challenge
Investigating security incidents has become fragmented
Security analysts investigate dozens of alerts every day while switching between disconnected tools,
fragmented evidence, and multiple investigation workflows.
As alert volumes continue to grow, finding the full story behind an incident becomes slower, more repetitive, and demanding.
before
After
RESEARCH
Understanding how analysts investigate incidents
Through user interviews, workflow analysis, and competitive research, I identified the recurring patterns that shaped the product direction.
What we learned
Constant context switching
Three recurring patterns consistently slowed security investigations.
1
Constant context switching
Analysts relied on multiple disconnected tools during every investigation.
2
Fragmented evidence
Critical information was scattered across different security platforms.
1
Slow investigation workflow
Manual investigation steps delayed incident response.
COMPETITIVE ANALYSIS
Learning from existing security platforms
I analyzed leading security platforms to identify recurring investigation patterns and uncover opportunities for a more connected investigation experience.
Reduce context switching
Existing platforms often require analysts to navigate across multiple views during a single investigation.
Connect investigation context
Related evidence, users, devices, and events should be visible within one continuous workflow.
Simplify complex investigations
Present critical information with a clear visual hierarchy to support faster decision-making.
DESIGN EXPLORATION
Exploring the design direction
Before committing to the final interface, I explored multiple layouts using AI, then refined the strongest concepts through hand sketches.
The selected direction was refined through quick hand sketches before moving into high-fidelity design.
AI was used to rapidly explore multiple interface directions before selecting a final design approach.
every step was designed to keep analysts focused within one connected investigation workflow.
FINAL SOLUTION
Designing a simpler way to manage complex projects
Helping analysts prioritize incidents from the moment their shift begins.
Review, prioritize, and investigate alerts without losing context.
Bringing the entire investigation into one connected workspace.
Visualizing the complete attack chain from entry to impact.
Providing the context needed to assess user risk with confidence.
Keeping technical evidence accessible throughout the investigation.
Reflection
This project taught me that good product design isn’t about reducing complexity, it’s about making complexity easier to navigate. Every design decision focused on helping analysts understand critical information faster without sacrificing the depth required for security investigations.
SOC analysts spend too much time switching between alerts, evidence and investigation tools.
AI Workspace • ProJECT Operations • 5 Weeks • solo desighner
Overview
Designed a unified investigation workspace that helps SOC analysts analyze alerts, connect evidence, and respond to security incidents from a single workflow.
The Challenge
Investigating security incidents has become fragmented
Security analysts investigate dozens of alerts every day while switching between disconnected tools,
fragmented evidence, and multiple investigation workflows.
As alert volumes continue to grow, finding the full story behind an incident becomes slower, more repetitive, and demanding.
before
Alert
SIEM
EDR
Identity
Threat Intel
SOC Analyst
Investigation data is scattered across disconnected tools
After
Alert
Investigation Workspace:
• Alerts
• Evidence
• Attack Path
• AI Insights
• Response Actions
SOC Analyst
Investigation data is unified into one workspace
RESEARCH
Understanding how analysts investigate incidents
Through user interviews, workflow analysis, and competitive research, I identified the recurring patterns that shaped the product direction.
What we learned
Constant context switching
Three recurring patterns consistently slowed security investigations.
1
Constant context switching
Analysts relied on multiple disconnected tools during every investigation.
2
Fragmented evidence
Critical information was scattered across different security platforms.
3
Slow investigation workflow
Manual investigation steps delayed incident response.
COMPETITIVE ANALYSIS
Learning from existing security platforms
I analyzed leading security platforms to identify recurring investigation patterns and uncover opportunities for a more connected investigation experience.
1
Reduce context switching
Existing platforms often require analysts to navigate across multiple views during a single investigation.
2
Connect investigation context
Related evidence, users, devices, and events should be visible within one continuous workflow.
3
Simplify complex investigations
Present critical information with a clear visual hierarchy to support faster decision-making.
DESIGN EXPLORATION
Exploring the design direction
Before committing to the final interface, I explored multiple layouts using AI, then refined the strongest concepts through hand sketches.
The selected direction was refined through quick hand sketches before moving into high-fidelity design.
AI was used to rapidly explore multiple interface directions before selecting a final design approach.
every step was designed to keep analysts focused within one connected investigation workflow.
FINAL SOLUTION
Designing a simpler way to manage complex projects
Helping analysts prioritize incidents from the moment their shift begins.
Review, prioritize, and investigate alerts without losing context.
Bringing the entire investigation into one connected workspace.
Visualizing the complete attack chain from entry to impact.
Providing the context needed to assess user risk with confidence.
Keeping technical evidence accessible throughout the investigation.
Reflection
This project taught me that good product design isn’t about reducing complexity, it’s about making complexity easier to navigate. Every design decision focused on helping analysts understand critical information faster without sacrificing the depth required for security investigations.
Reflection
This project taught me that good product design isn’t about reducing complexity, it’s about making complexity easier to navigate. Every design decision focused on helping analysts understand critical information faster without sacrificing the depth required for security investigations.