Follow stream · CASE 06 · Security Engineering · Detection · Bank of Maharashtra Hackathon · Problem statement PS1

Panoptes

Insider-threat detection that knows an admin is not an anomaly.

Hackathon prototype

Runs end to end on synthetic identity logs, built for a hackathon problem statement.

A detection platform for privileged-access misuse and insider threats. It baselines each user against their peer group, models action sequences, enforces real OPA policy decisions and protects its own audit trail with post-quantum cryptography.

Source code ↗

01 Lab: walk the anomaly scenarios

The eight insider-threat scenarios the platform was built and tested against.

  • Off-hours bulk exportCRITICAL 90+
  • Privilege escalation chainCRITICAL 85+
  • Contractor scope violationHIGH 75+
  • Lateral movementCRITICAL 80+
  • Mass deletionCRITICAL 90+
  • Shadow admin creationCRITICAL 85+
  • Data exfiltration prepHIGH 75+
  • Credential stuffingHIGH 70+

Scenarios and expected risk bands are the eight documented in the Panoptes README. Their logs are synthetic, generated for the hackathon.

02 Brief

The problem

Generic SIEM thresholds treat every database admin exporting data as an anomaly, or none of them. Insider threats hide inside legitimate privilege, so detection has to know what normal looks like for this role.

Why it matters

The most damaging access is the access that was granted. Detecting misuse of legitimate privilege is a modelling problem, not a signature problem.

03 Architecture

A FastAPI stream processor scores sessions continuously, fuses the scores into an explained risk value, enforces policy through OPA and writes a PQC-signed audit log.

Panoptes architecture: synthetic identity logs stream into a FastAPI processor that resolves identity and peer group, scores sessions with a KMeans peer baseline and a Markov sequence model, fuses them into a 0 to 100 risk score with reasons, and asks an OPA Rego policy for a verdict: kill session, step-up MFA or log only. Audit entries are signed with ML-DSA-65 and credentials vaulted with ML-KEM-768.STREAM PROCESSORIdentity logs50 ids · 8 scenariosPeer baselineKMeans + z-scoreSequence modelMarkov per groupRisk fusion0–100 + reasonsOPA / Regopolicy verdictKILLSTEP-UPLOGPQC audit + vaultML-DSA-65 signed log · ML-KEM-768 credentials
FIG. 06From privileged session to enforced verdict
  1. 01

    Synthetic log generator

    50 identities with 8 embedded anomaly scenarios: bulk export, privilege chains, lateral movement and more.

  2. 02

    Peer-group baselines

    KMeans peer groups with z-score deviation, so an admin is compared with other admins.

  3. 03

    Sequence model

    A Markov chain per peer group catches suspicious orderings, such as LOGIN → ESCALATE → MODIFY → MODIFY.

  4. 04

    Risk fusion

    A composite 0–100 score with a per-session reason breakdown.

  5. 05

    OPA policy engine

    Real Rego evaluation decides Kill Session, Step-Up MFA or Log Only.

  6. 06

    PQC layer

    ML-KEM-768 credential vault and ML-DSA-65 signed audit entries with tamper detection.

04 Implementation

Stack

Python · FastAPI · scikit-learn · OPA / Rego · ML-KEM-768 · ML-DSA-65 · SQLite · React · WebSockets

My contribution

Sole committer on the public repository.

  • An asyncio background task processes the event stream and pushes alerts to a React SOC dashboard over WebSockets.
  • Drilling into a critical session shows the action timeline, the score breakdown and the OPA verdict.
  • Audit-log tampering is detected by re-verifying the ML-DSA signatures.

05 Engineering decisions

  1. Compare like with like

    Global thresholds either flood or miss. Peer-group baselining makes 'unusual' relative to the role.

  2. Enforce, don't just alert

    Policy decisions run through OPA, so the response is a real verdict (kill session or step-up MFA), not just another dashboard tile.

06 Evidence

No published results yet. This file is at the hackathon prototype stage, and results will be added once they can be backed by evidence.

Sourced from: github.com/Prathamesh0-0/panoptes README