GCP Threat Hunting Pipeline

Security teams are drowning in millions of alerts. This project demonstrates a system that tells normal traffic from real attacks, automatically and near-instantly, across 700,000 real network connections. Performance was multiplied by 4 through the right architectural optimizations.

Threat hunting platform on GCP. RandomForestClassifier · 40 features · ROC-AUC ~0.98 · <5ms inference · AbuseIPDB enrichment (24h Redis cache). Optimization: 16 → 64 RPS (×4.1) with a B-Tree index on (srcip, ts, proto) + materialized view + Redis cache. 4 CI/CD security gates: Bandit · pip-audit · Trivy · Checkov. 10+ Prometheus alerts.