Nnanna Adaobi Evelyn

SOC Analysis project

TraceSOC — An Evidence-First SOC/DFIR Reconstruction Engine

Security investigations often end with an alert or report, but it can be difficult to prove exactly which logs, email, or network evidence supports each conclusion. That makes investigations harder to review, reproduce, hand over to another analyst, or defend when a conclusion is challenged. TraceSOC is a lightweight security investigation engine I built to preserve that evidence chain. It reads supported email, Windows and network evidence, organizes it into a common format, tests it against behavioural detection and correlation rules, produces evidence-backed findings, and lets a reviewer trace those findings back to the original source data. In its controlled six-source reference case, all 5,442 analyzed observations retained a path back to raw evidence. The final build also passed 524/524 regression tests and 4/4 public acceptance classes. TraceSOC is designed for SOC analysts, incident responders, DFIR practitioners and detection engineers who need investigations that are reproducible, auditable and honest about uncertainty.