Adding Real-Time Detection Features to the CDR Dashboard

We enhanced the Cloud Detection & Response dashboard by integrating live streaming and real-time threat processing. This empowered security analysts to monitor and respond to threats instantly, rather than relying on retrospective data.

My role

As the lead product designer, I led user research, defined requirements with cross-functional teams, and designed the real-time alerting interface with a focus on usability and efficiency.

The problem

Security teams relied on delayed data, reducing their ability to respond quickly. Analysts had to refresh logs manually or wait for periodic updates.

Goal

• Detect threats instantly.
• Surface clear, actionable alerts — reducing analyst fatigue.
• Help prioritize alerts and focus on the most critical threats.
• Integrate seamlessly into existing workflows.

To validate the approach, I ran:

• User interviews with analysts to uncover real-world friction points.
• Competitive benchmarking of real-time security monitoring tools.
• Feasibility analysis with engineering on data processing constraints.

Key insights

1. Analysts needed an intuitive way to track live threats without alert fatigue.
2. Grouping similar threats was essential to reduce information overload.
3. Quick-response actions (isolate, dismiss) were critical to streamline triage.
4. Analysts needed custom filters and sorting to focus on relevant threats.

1. Understanding user needs — interviewed analysts, worked with PMs to prioritize, aligned on technical feasibility with engineering.
2. Stakeholder alignment — led cross-team discussions, facilitated workshops to validate early concepts.
3. Wireframing & prototyping — created multiple UI versions, developed interactive prototypes for live-update simulation.
4. Iterative refinement — refined event timeline, alert grouping, quick actions; added filtering and sorting to reduce overload.

The final design introduced a Live Streaming panel that dynamically updated threat events in real time.

1. Real-Time Event Timeline — visual timeline of threat patterns.
2. Severity-Based Grouping — critical alerts prioritized; related threats grouped to reduce noise.
3. Contextual Drill-Down — expanded view with details and evidence.
4. Quick Action Controls — respond without leaving the dashboard.
5. Customizable Filters & Timeframes — refine event streams.

This project showcased:

• The power of early stakeholder alignment.
• The importance of designing for high cognitive load.
• A UX-led approach to building real-time, high-impact features.