90-second YouTube walkthrough — OpenSOC

Total: 90 seconds, broken into four ~25-second beats. Record at 1080p, unlisted, no music (optional 5-second outro card).

Beat 1 — Problem (0:00–0:15)

Visual: cursor blinking on a SOC dashboard with a queue of unread alerts; zoom into one alert that says Authentication failures (8 attempts) from 198.51.100.7.

Voiceover (suggested):

"By the time a tier-1 analyst sees an alert like this, the attacker may have been inside for hours. Most SOCs are understaffed, and a real attack that gets dismissed by a tired human is invisible until it's too late."

Beat 2 — Env demo (0:15–0:40)

Visual: the deployed https://...hf.space/demo page. Click "Next incident" three times; pause briefly on each example.

Voiceover:

"OpenSOC is an OpenEnv environment where the same alert is shown to two models. On the left: zero-shot Qwen2.5-3B; on the right, the same model after we trained it inside this environment with GRPO. The verifier in the middle decides what 'right' is — deterministically, from the structured incident parameters, never from any text the attacker writes."

Beat 3 — Before vs after (0:40–1:05)

Visual: split screen — left half shows the eval bar chart bar_dismiss_on_malicious.png; right half shows the confusion matrix confusion_opensoc_grpo.png.

Voiceover:

"On a 200-incident hold-out, the baseline dismisses real attacks at [BASELINE]%. After SFT warm-start plus GRPO across four curriculum stages, dismiss-on-malicious drops to [TRAINED]% — and macro F1 lifts from [BASELINE_F1] to [TRAINED_F1]. Over-reaction on benign traffic didn't get worse."

Beat 4 — Why RLVR (1:05–1:30)

Visual: a single code editor pane showing verifier.compute_ground_truth(params) and verifier.check_plausibility(params); highlight that both are pure functions of the structured params.

Voiceover:

"The reason this works is that the reward is computed from the structured attacker parameters, not from any narrative. The plausibility checker blocks the trivial reward hack of just emitting noise. That's what makes this RLVR — verifiable rewards, no learned judge to fool. Code, eval set, training notebook and a $3 GPU recipe are all in the repo."

Closing card (1:30)

Title: OpenSOC — RLVR self-play SOC triage URL: huggingface.co/spaces/<USER>/opensoc-env GitHub-style logo: optional

Recording tips

Use OBS or Loom; export as 1080p mp4.
Pre-load the Space on /demo and click "Next incident" once before recording so the first paint isn't cold.
Keep terminal font size large; favour Bear Notes / OBS overlays for the voiceover beats over fullscreen code.
Upload as unlisted; share the URL in the README and the HF blog.