A centralized monitoring platform designed to detect security and compliance violations across enterprise ecosystems.
It leverages a single, unified workspace framework to handle both high volume data operations and real time conversational AI guardrails.

Activity Monitoring users are SOC Analysts: Front-line enterprise investigators tasked with monitoring, identifying, and responding to security threats. The design was grounded in direct input from customer calls and PM conversations. Two pain points came up consistently: alert volume with no clear way to prioritize, and alerts that didn't surface enough context to act on- forcing analysts into separate tools to piece together what happened. Those two inputs became the design's core constraints: a high-density filterable grid to handle volume, and an inline detail panel rich enough to eliminate the need to go elsewhere.

• Rapid Context: Immediate visibility into the incident's details to verify threats without digging through raw logs.
• Unified Tooling: A single, predictable interface that handles diverse risk vectors like file telemetry and conversational AI streams.

• Cognitive overload: Mass data volume and system noise that make it difficult to isolate high-risk threats from benign activity.
• Context switching: Navigating fragmented, inconsistent tools or shifting between completely different interaction models for different alert types.

• Decision Efficiency: High-density layouts, clear severity syntax, and immediate filtering controls that cut down time to remediation.
• Predictable Workflow Patterns: Consistent UI structures and identical action layouts that allow analysts to rely on muscle memory.

• One product, not three. The original plan called for three separate pages: an Activity Explorer for raw activity logs, a Security Alerts view for policy-triggered incidents, and a dedicated policy management space. Instead, we consolidated all three into a single workspace. Analysts shouldn't have to leave the tool they're investigating in to manage the policies that drive their alerts- keeping everything in one place closes the loop between monitoring, investigation, and policy action without context switching between products.
• Overlay panel, not page navigation. When an analyst clicks an alert, the detail panel opens as an overlay above the live grid, not a new page. Navigating away would destroy mental context: their place in the list, active filters, the scan rhythm. Everything they were tracking stays visible behind the panel.
• Actor grouping mirrors how investigations actually unfold. Analysts don't just investigate individual alerts in isolation, they investigate people as well. Once a suspicious actor is identified, the next question is always "what else did they do?" Grouping alerts by actor surfaces that pattern immediately, without requiring a manual cross-reference.
• One elastic container, not a different panel per alert type. SOC analysts process different alert types per shift. Unique panel layouts per type would force a mental reorientation on every click. A single, predictable panel structure with fixed metadata at the top and a type-specific data zone below lets analysts build muscle memory that works across all alert types. It also scales: as new alert types are added to the product, they slot into the same container without requiring new panel designs or breaking the established workflow.