What it is
The threat intelligence platform I architected and built at Safaricom. It ingests from OSINT and dark web sources, correlates semantically rather than by keyword, and pushes automated response into the existing EDR and SIEM estate.
Python, FastAPI, PostgreSQL with pgvector, microservices on GKE.
Scale and behaviour
- Over 100,000 events processed daily from OSINT and dark web feeds.
- Sub-second vector retrieval across millions of indicators.
- Analyst response time reduced by roughly 95 percent, through orchestration rather than faster manual triage.
That last number is worth being precise about. The platform did not make analysts read faster. It removed the steps where a human was forwarding context between tools.
The analysis engine
Built on Vertex AI and Gemini, handling three jobs that previously consumed analyst hours:
- Automated threat summarisation, turning raw indicator dumps into something an analyst can act on.
- MITRE ATT&CK technique mapping, extracting tactics and technique IDs from unstructured threat descriptions.
- TTP and CWE classification, giving consistent categorisation across sources that do not agree on vocabulary.
Why pgvector
Semantic correlation is the point. Keyword search cannot connect "malicious PowerShell script detected on endpoint", "suspicious PS1 execution observed" and "command-line obfuscation via encoded PowerShell". They are the same threat in three vocabularies.
Running vectors inside PostgreSQL rather than a dedicated vector database kept relational and vector data in one system, with one set of ACID guarantees and one operational surface. For threat intelligence, where provenance and consistency of the indicator record matter as much as retrieval, that was the right trade.
Integration
Automated incident response wired into EDR and SIEM, so a correlated, high-severity indicator triggers containment and analyst alerting without a human relaying it between consoles.