Build a Bank Incident Triage System with Mastra AI and Helicone
Sophisticated nation-state cyber campaigns targeting core banking telemetry require automated incident response workflows. Build an autonomous cyber threat triage pipeline using Mastra AI integrated with Helicone for observability and cost tracking. Process SIEM logs and automatically quarantine compromised endpoint nodes with 99% accuracy.
What you are building
Develop a TypeScript threat triage agent using Mastra AI and Helicone observability to detect cyber intrusion indicators in banking systems.
How work is evaluated
Evaluate the triage system's ability to categorize threat logs and trigger correct mitigation policies.
Datasets
Public datasets, plus the private datasets you have access to.
How submissions are scored
Contain Host on Injection
Ensure immediate containment recommendation upon dynamic injection trigger.
This dimension contributes its full weight only when the submission satisfies the requirement. Partial credit is not awarded.
Detection Accuracy
Accuracy in distinguishing actual cyber intrusions from benign system alerts. • target: 0.99 • range: 0-1
This dimension contributes its full weight only when the submission satisfies the requirement. Partial credit is not awarded.
Learning goals
Build a TypeScript-native threat analysis workflow using Mastra AI
Implement Helicone proxy observability to trace LLM latency and prompt costs during security incident response
Map attack vectors to the MITRE ATT&CK enterprise matrix in real time
Trigger dynamic containment actions based on threat risk scoring
Resources
Synthetic telemetry dataset comprising 10,000 security logs derived from typical core banking database and API gateway access patterns.
Challenge setup
Evaluate the triage system's ability to categorize threat logs and trigger correct mitigation policies.
Challenge input
JSON array of security event logs containing host, event_type, IP, process_name, and severity.
Mastra AI
Provides robust TypeScript primitives for building workflow agents.
Helicone
Offers latency tracking, caching, and cost control across high-volume security logging.
Evaluated output
JSON object with threat_detected (boolean), mitre_technique_id, and action_taken.
- Ensure immediate containment recommendation upon dynamic injection trigger.
- Accuracy in distinguishing actual cyber intrusions from benign system alerts. • target: 0.99 • range: 0-1
- Benchmark: CyberSecAgentBench
- Detection Accuracy target: 0.99
- 1 public reference case
- JavaScript execution harness
- javascript sandbox (unavailable on Versalist)
Shows the first task, up to three tools, and up to three evidence items.
View technical recipe
Configured tools
- Mastra AI · Optional
- Helicone · Required
- Mastra AI · Optional
Evaluation contract
- Contain Host on Injection · Weight 1
- Detection Accuracy · Weight 1
Metrics
- Detection Accuracy · Target 0.99
Benchmarks
- CyberSecAgentBench
- security
Reference cases
- 1 public reference case
Workflow tasks
- Task 1
Input: JSON array of security event logs containing host, event_type, IP, process_name, and severity.
Output: JSON object with threat_detected (boolean), mitre_technique_id, and action_taken.
Execution harness: JavaScript
Evaluation tools
- Mastra AI · Agentic TypeScript Framework
- Helicone · AI Workflow Observability
Recipe freeze marker
No recipe freeze time is recorded.