# Cybersecurity Intelligence

From vulnerability information to explainable priorities.

[HTML](https://leohteixeira.com/en/projects/cybersecurity-intelligence) · Leonardo Teixeira

## The product

Cybersecurity Intelligence correlates public advisory information with registered technology profiles. Its product model separates source evidence, canonical advisories, affected-version matching and prioritized findings so an engineer can inspect why a technology was flagged.

Stack: C#, .NET, ASP.NET Core, React, TypeScript, PostgreSQL, OpenTelemetry

## The main flow

1. **Register a technology profile** — Technology and version information define the scope for correlation. The application uses a protected session; the access screen is its public entry.

2. **Normalize advisory evidence** — Source adapters convert provider records to canonical advisories, keeping external formats outside the domain model.

3. **Inspect explainable findings** — Version matching and risk scoring follow deterministic rules. Evidence and matching reasons support investigation; an LLM may explain a result rather than determine the match.

## Architecture

```text
Public advisory sources → adapters → canonical advisories → PostgreSQL
Technology profile → deterministic version matching + scoring → explainable findings
React ↔ ASP.NET Core API → Application → Domain · Worker → ingestion
```

### A .NET modular monolith

ASP.NET Core API and Worker Service depend on Application and Domain. Infrastructure implements PostgreSQL, source and provider adapters. Domain and Application do not reference Infrastructure.

### A versioned application boundary

React communicates through HTTP/JSON contracts. The product separates deterministic correlation from optional model explanations and instruments processing with OpenTelemetry.

## Availability and limits

A portfolio project under active development. The public presentation describes its product model and architecture; it does not certify source coverage, live collection freshness or complete production readiness. Application access requires a session. Public demo and source links appear only when configured.

Public demo not configured.

Public source not configured.