Why Static Dashboards Are Dead: Engineering the Dynamic Posture Score in SIEM+

Published on: Eventus Engineering Blog (eventus.blog)
Author: Eventus Technologies Engineering Team

In the cybersecurity industry, we have a terrible habit of equating “volume” with “risk.” If a traditional SIEM dashboard shows 10,000 alerts, the status indicator turns red, the posture score plummets to zero, and executives panic.

But as any Tier-1 SOC analyst knows, a simple automated port scan against a public-facing IP can generate 5,000 raw firewall drops in three minutes. That isn’t 5,000 separate critical threats; it is a single, low-level event.

When we built SIEM+ (siem.plus), we knew that if we just fed raw alert counts into a UI, we would be recreating the exact same “alert fatigue” we set out to destroy. We needed a way to translate noisy data lakes into a boardroom-ready metric that reflects actual risk.

Here is a deep dive into how we engineered the SIEM+ Dynamic Posture Score, our penalty decay algorithm, and how we force LLMs to map threats to compliance frameworks without hallucinating.

🧠 Step 1: Case Grouping (De-duplication of Intent)

The first step to generating a real security score is stopping the AI from treating every log as an isolated incident.

Because we use an event-driven aggregation layer (pulling lightweight summaries from the underlying data lake), our AI engine receives batches of activity. We engineered our LLM pipeline to perform Intent De-duplication.

If the AI engine sees 50 failed login attempts followed by an MFA bypass for the same user, it does not output 51 alerts. It generates a single JSON object: a Case. This Case contains the root cause, the timeline, and the severity. This dramatically reduces the denominator for our scoring engine.

⚖️ Step 2: The Penalty Decay Algorithm

Once we have consolidated the noise into distinct Cases, we need to calculate the actual Posture Score (0–100) for specific security categories, such as Identity & Access Management and Network Boundary.

Instead of a linear deduction (which drops the score to zero too quickly), we implemented a customized penalty decay algorithm based on the severity of the grouped Cases, not the raw alerts.

Our scoring engine evaluates two main factors:

1. Severity Weighting: Each case is assigned a base penalty score. Critical events carry a heavy penalty, while Low events carry a minimal one.
2. Logarithmic Decay: If a flood of similar cases occurs simultaneously, the system applies a decay function. Successive events of the same type do not subtract the full penalty amount over and over.

This logic ensures that a single critical MFA bypass actually hurts the posture score far more than 1,000 low-level firewall pings, providing a much more accurate reflection of true infrastructure risk.

🛡️ Step 3: Dynamic Framework Mapping (NIST & CIS)

Static compliance dashboards are notoriously brittle. They rely on hardcoded rules, such as “If Rule ID 404 fires, flag NIST PR.AC-1.” The moment your infrastructure changes, the mapping breaks.

We configured the SIEM+ AI engine to dynamically map Cases to NIST CSF v2.0 and CIS Controls v8. To do this without the LLM hallucinating fake compliance codes, we use strict system prompts infused with RAG (Retrieval-Augmented Generation) context from the official framework documentation.

The AI evaluates the nature of the attack—such as an unauthorized email forwarding rule—and maps it to the exact control family being violated.

🏗️ Step 4: Taming the AI with Strict Data Contracts

One of the hardest parts of building an AI-driven platform is taming the unpredictability of LLMs. You can’t just feed raw, conversational text into a structured enterprise dashboard and expect it to render correctly.

Even though our end-users never interact with raw code or JSON—they simply see a sleek, executive-ready interface—our backend relies heavily on deterministic data contracts. We force the LLM to output strictly formatted JSON payloads, constraining it to our exact schema and penalizing it heavily if it hallucinates extra fields.

To give you an idea of how the AI engine talks to the UI, here is a peek behind the curtain at the structured intelligence generated behind the scenes:

{
  "ui_category": "Cloud & Infrastructure Security",
  "has_log_coverage": true,
  "score": 72.5,
  "cases": {
    "critical": 0,
    "high": 2,
    "medium": 4
  },
  "frameworks": {
    "nist_v2": "PR.DS",
    "cis_v8": "CIS_CONTROL_5"
  },
  "evidence_string": "Score degraded due to 2 High-severity cases: Public S3 bucket misconfiguration and unauthorized IAM role assumption."
}

The Result: Actionable Security

By combining Case Grouping, the Penalty Decay algorithm, and dynamic JSON schema generation, SIEM+ bridges the gap between the SOC floor and the executive boardroom.

Security engineers get the exact context and remediation steps they need, and CISOs get a mathematical, defensible Posture Score that accurately reflects their infrastructure’s health.