# ISEA RAG Attack Classification
**Stack:** Python, Qdrant, Hugging Face Embeddings, Isolation Forest, LOF, MITRE ATT&CK, Docker, Pandas, Snowflake, FastAPI
**Date:** February 2026
## Overview
End-to-end cybersecurity pipeline converting raw logs into session intelligence, hybrid detection scores, and MITRE ATT&CK mapping using retrieval-augmented generation.
## Key Highlights
- Built a cybersecurity analytics pipeline with hybrid anomaly detection and sessionization for raw security logs.
- Implemented RAG-based ATT&CK mapping using Hugging Face embeddings and Qdrant to connect suspicious sessions to MITRE techniques.
- Delivered explainable analyst reports with IP-to-technique mappings, confidence scoring, and visualizations of detection results.
- Project details coming soon.
## Features
- Raw log ingestion and sessionization into structured event timelines
- Hybrid anomaly detection using rules plus Isolation Forest or LOF
- MITRE ATT&CK knowledge base download, cache build, and vector indexing
- Qdrant-powered retrieval to map suspicious sessions to techniques
- End-to-end reporting with source IP to tactic-technique summaries
- Evaluation pipelines for proxy and labeled modes
- CLI-driven phase-based workflow for reproducible analytics
## Tech Stack
Python, Qdrant, Hugging Face Embeddings, Isolation Forest, LOF, MITRE ATT&CK, Docker, Pandas, Snowflake, FastAPI
---
For more details, check out the [Projects](/projects) page or explore other [Experiences](/experience).