CyberNyx - Security Detection Platform

A cybersecurity platform that turns Wiz exposure data into Splunk detection rules mapped to MITRE ATT&CK.

Role: Security Engineer + Full Stack Developer. Team: Individual. Status: Working Prototype. Year: 2026.

Overview

CyberNyx ingests exposure data from the Wiz GraphQL API and maps the relationships in Neo4j. It identifies security coverage gaps, gives analysts the context behind each gap, and uses GPT-4 to generate Splunk detection rules mapped to MITRE ATT&CK.

Generated rules go through a human review workflow before deployment. PostgreSQL keeps the rule ledger and audit trail, while Redis buffers ingestion and caches expensive graph queries.

Stack:

• Backend: Python and FastAPI
• Graph: Neo4j
• Data: PostgreSQL and Redis
• AI: GPT-4
• Integrations: Wiz GraphQL API and Splunk HEC
• Frontend: React

Key features

• Wiz exposure ingestion through a Redis-buffered GraphQL connector
• Neo4j graph of assets, exposures, and relationships
• Coverage gap detection mapped to MITRE ATT&CK
• GPT-4 generation of Splunk detection rules
• Human review workflow before rules reach Splunk
• Redis caching for expensive Cypher query results
• PostgreSQL rule ledger and audit trail

Technical details

• Graph: Neo4j, Cypher queries with subgraph extraction
• AI: OpenAI GPT-4 with JSON mode for structured outputs
• Cache: Redis for Cypher query memoization
• Rule ledger: PostgreSQL for review and deployment history
• Backend: FastAPI + async Neo4j driver
• Frontend: React with approval workflow UI
• Deploy: Cloud Run backend + Vercel frontend, Docker Compose locally

Challenges

• Precomputing the right subgraph so GPT-4 reasons over a digestible slice
• Modeling diverse security relationships in a graph schema that stays readable
• Balancing automation with human oversight for detection rules
• Testing detection rules without production impact

Tags: Python, FastAPI, Neo4j, PostgreSQL, Redis, GPT-4, React