A working Security Operations Center built from open-source parts and driven with real telemetry from real machines — not synthetic demo data. This repository is a curated, public showcase of the detection engineering, telemetry pipeline, and lab automation. The full platform lives in a separate private repository.
▶ Live dashboard: (enable GitHub Pages on this repo — see below)
The landing page (index.html) is a sci-fi command console rendered from a real snapshot of
the running lab.
| Layer | Implementation |
|---|---|
| SIEM core | FastAPI + PostgreSQL + Redis + OpenSearch + Vector, Dockerized, behind a Caddy TLS proxy |
| Detection | A real Sigma engine with logsource routing + field-mapping, running 618 rules (18 custom + 600 vendored SigmaHQ) |
| Correlation | Stateful threshold + sequence engine (brute-force, password-spray, multi-stage kill-chains) |
| Endpoints | 2 real VirtualBox VMs — Ubuntu 24.04 (auditd → rsyslog) and Windows 11 (Sysmon), each running a Wazuh agent |
| Attack simulation | Atomic Red Team on the Windows victim |
| Enrichment | AbuseIPDB + VirusTotal + OTX with consensus scoring; self-hosted IOC store |
- 2 live endpoints + a SOC core, both Wazuh agents enrolled and Active simultaneously
- Real attack chain detected end-to-end: Recon → Credential Access (T1003) raised a critical multi-stage kill-chain alert from genuine host telemetry, not an injected event
- Detections on real data include encoded PowerShell, Mimikatz, LOLBins, and Linux discovery — plus vendored SigmaHQ rules firing on real activity for the first time
- Host under load during the run: 68% CPU / 83% RAM (AMD Ryzen 5 5500U, 12 threads)
index.html the live command-center dashboard (GitHub Pages)
detection/rules/*.yml the 18 custom Sigma rules (Windows, Linux, cloud, WiFi, exfil)
detection/correlation/*.yml threshold + sequence correlation rules
pipeline/auditd_normalizer.py Linux auditd -> ECS (the parser that made Linux rules fire)
pipeline/threat_intel_scoring.py TI consensus scoring + the false-positive story
lab/provision_linux_endpoint.sh turns a bare Ubuntu VM into a monitored endpoint
lab/provision_windows_endpoint.ps1 Sysmon + Wazuh + Atomic Red Team on a Windows victim
docs/ENGINEERING-NOTES.md the bugs that only real telemetry exposed, and their fixes
This is a subset, chosen for signal — the full FastAPI backend, frontend, and infrastructure are not published here.
Most of the engineering value in this project came from pointing real machines at it and
fixing what broke. A rule that fired wrong on real traffic and was then tuned is stronger
evidence than a rule that passed a test its author wrote. See
docs/ENGINEERING-NOTES.md for the specifics — including a
threat-intel scoring bug that produced ~82% false positives on live traffic and how it was
diagnosed in layers and fixed.
- Push this directory to a new public GitHub repository.
- Settings → Pages → Build and deployment → Source: Deploy from a branch.
- Branch:
main, folder:/ (root). Save. - The dashboard goes live at
https://<user>.github.io/<repo>/in ~1 minute.
SIEM · SOAR · Sigma · MITRE ATT&CK · Detection Engineering · Wazuh · Sysmon ·
auditd · OpenSearch · Docker · Atomic Red Team · Threat Intelligence · Python ·
FastAPI
Lab snapshot and dashboard data are real measured values. The dashboard's packet animation is scripted; it is a self-contained portfolio piece, not a remote console.