A prototype GreyNoise integration for FluentBit with Lua scripts.

Notif360 is an open-source system monitoring and notification tool designed to provide comprehensive oversight of critical system metrics, website health, and malware scanning

Network Access Control (NAC) + Security Information and Event Management (SIEM) + Continuous Threat Exposure Management (CTEM)

This repository stores tables for use in SEIM tools (specifically Sumologic)

First attempt at a lambda architecture SEIM using Power BI & Azure Sentinel

Basic Intrusion Detection System using Scapy

Enterprise-style Wazuh SIEM homelab featuring Windows & Linux monitoring, Sysmon, Auditd, custom detections, threat hunting, incident response, and MITRE ATT&CK mapping.

My SOC Level 1 study notes from TryHackMe. Covers threat intelligence, SIEM investigations, digital forensics, endpoint monitoring, and phishing analysis, with practical labs using tools like Splunk, Wireshark, Sysmon, and Volatility.

Hands-on Wazuh SIEM deployment with Windows and Linux endpoints, File Integrity Monitoring (FIM), and Threat Hunting.

A self built log monitoring and alerting tool. Parses SSH auth logs with Bash and Python to detect brute force attacks and privilege escalation, renders the findings in a custom JavaScript dashboard, and ships with Splunk SPL queries for SIEM style correlation.

CTI Lab 2 — Malicious File Analysis, ELK Stack, Purple Teaming (MITRE ATT&CK), and Elastic SIEM Alerting exercises. Tools: Sysmon, Atomic Red Team, Kibana, VirusTotal.

seim + idr without an api

Mini-SIEM is a lightweight, dark-themed security monitoring dashboard that simulates attacks, tracks incidents by severity, and helps you practice real-world SOC skills in Python.

Security Event and Incident Management: A security software that helps recognize and address potential security threats and vulnerabilities.

Workaround to organisations lacking Enterprise Tier for GitHub SEIM logging

Installed and configured Splunk Enterprise, created a SOC Lab index, and prepared a SIEM environment for future log ingestion and security investigations.

Enterprise-style offensive security range: segmented pfSense architecture, intentionally vulnerable AD forest, detection engineering. Ongoing build.

Splunk SIEM investigation lab with SPL detection rules, BOTS dataset analysis, and IR reports mapped to MITRE ATT&CK

Personal SOC lab built on Wazuh + Suricata to practice detection engineering, alert triage, and incident investigation.

AI-powered SOC alert triage pipeline. Wazuh → enrich → dedup → rules → LLM → Graylog.