Design Security Dashboard - System Design | WinJob

SOC Console Mission and Analyst Personas

Context (sec-001)

Design a unified security operations console—Datadog Security/Splunk ES posture—for tier-1 through tier-3 analysts, not a replacement SIEM backend.

Mechanisms

Personas — Tier-1 triages queues; tier-2 hunts; tier-3 tunes detections and dashboards.
North-star — One pane for alerts, cases, intel, and posture scorecards with drill-down to raw telemetry.
MSSP mode — Tenant switcher with color-coded context prevents wrong-customer actions.

Operational invariants

Read-heavy — 99% of requests are reads; writes are case comments, status changes, assignments.
Freshness labels — Every tile shows as_of timestamp when rollups lag ingest.

Phase emphasis (order 1)

Interviewers want to hear how you reduce mean-time-to-triage without boiling the ocean on day one.

Failure and edge cases

If Elasticsearch behind tiles is red, degrade to precomputed snapshots rather than blank screens—analysts still need situational awareness.

Capacity snapshot

Signal	Value
Analysts	800
Tenants	2,000
Alerts/day	3.2M
Open cases peak	48k

Reference implementations

javaOne Dark Pro

1 public final class SeverityGate {
2   private static final Map<String, Set<String>> ALLOWED = Map.of(
3     "open", Set.of("triaged", "suppressed"),
4     "triaged", Set.of("investigating", "closed"),
5     "investigating", Set.of("contained", "closed")
6   );
7   public boolean transition(String from, String to) {
8     return ALLOWED.getOrDefault(from, Set.of()).contains(to);
9   }
10 }

pythonOne Dark Pro

1 def alert_fingerprint(tenant: str, rule: str, entity: str, bucket: str) -> str:
2     import hashlib
3     raw = f"{tenant}|{rule}|{entity}|{bucket}".encode()
4     return hashlib.sha256(raw).hexdigest()[:24]

typescriptOne Dark Pro

1 export interface DashboardTile {
2   tenantId: string;
3   widgetId: string;
4   refreshMs: number;
5   queryHash: string;
6 }
7  
8 export function cacheKey(tile: DashboardTile): string {
9   return `${tile.tenantId}:${tile.queryHash}:v2`;
10 }

Why interviewers care

Security Dashboard interviews reward crisp scope, explicit trade-offs, and failure stories—not generic microservice diagrams.

Interview checkpoint

Name one failure story for SOC Console Mission and Analyst Personas that proves you understand real outages, not happy-path diagrams.

Key Highlights

•Tier-1 triages queues; tier-2 hunts; tier-3 tunes detections and dashboards.
•One pane for alerts, cases, intel, and posture scorecards with drill-down to raw
•Tenant switcher with color-coded context prevents wrong-customer actions.

1	public final class SeverityGate {
2	private static final Map<String, Set<String>> ALLOWED = Map.of(
3	"open", Set.of("triaged", "suppressed"),
4	"triaged", Set.of("investigating", "closed"),
5	"investigating", Set.of("contained", "closed")
6	);
7	public boolean transition(String from, String to) {
8	return ALLOWED.getOrDefault(from, Set.of()).contains(to);
9	}
10	}

1	def alert_fingerprint(tenant: str, rule: str, entity: str, bucket: str) -> str:
2	import hashlib
3	raw = f"{tenant}\|{rule}\|{entity}\|{bucket}".encode()
4	return hashlib.sha256(raw).hexdigest()[:24]

1	export interface DashboardTile {
2	tenantId: string;
3	widgetId: string;
4	refreshMs: number;
5	queryHash: string;
6	}
7
8	export function cacheKey(tile: DashboardTile): string {
9	return `${tile.tenantId}:${tile.queryHash}:v2`;
10	}