Abstract Security Pipeline Builder

Client Context

Security teams route logs from many vendors (Datadog, ServiceNow, AWS, CrowdStrike) through a middle layer before they reach destinations like S3 or Splunk, where customers pay per volume ingested. Abstract Security needed a no-code builder so those teams could dedupe, filter, and enrich streams without writing streaming code, from zero to GA.

Execution

Built the drag-and-drop node graph, nested conditional rule editing stored as an ordered JSON structure the UI and backend both relied on, an AI rule builder, and a library of reusable rule blocks shareable across the org or kept personal under RBAC. Wired 50+ FastAPI endpoints behind typed Pydantic contracts with shared authn/authz, built 20+ telemetry source integrations, and designed a templating layer that turned each new connector from a custom build into a declarative config.

Outcome

Shipped zero to GA and was adopted by the full customer base at launch. Connector delivery dropped from 4 weeks to 1.5 weeks, runtime client errors fell 60% (50 → 20 per week), and React Query cache partitioning, cursor pagination, and debounced abortable fetches held sub-100 ms interaction latency under peak production load.

Why It Mattered

Every vendor used to be its own custom build. Turning that into a template plus config meant one engine could serve many consumers, and each edge case folded back into the template made the next integration easier instead of harder. It is also where the ownership grew, from assigned tickets to owning the builder's front-end architecture and the API contracts behind it.