securityoperationscenter

Sovereign kubernetes security operations center. Real-time false positives tuning

This repository hold a complete step by step documentation of the creation of a Security Operations Center SOC home lab.

A hands-on SOC Automation Lab built using Wazuh, TheHive, Cortex, and ELK. Demonstrates real-time threat detection, alert forwarding, and automated incident response in a simulated enterprise environment.

Agentic Physical Security Platform- Edge AI

Practical SOC monitoring, threat detection, incident investigation and response lab using Wazuh and Sysmon.

An Open-source Ready SOC in a dockerized environment

Blue-team toolkit for endpoint triage, forensic evidence collection, security audits, and readable reports across Linux and Windows.

AI-powered SOC pipeline with triage, investigation, and response agents

Cybersecurity testing and research lab

This detection engineering repo is for the Detection as Code CI/CD pipeline

A Security Operations Center (SOC) Home Lab showcasing endpoint telemetry collection, detection engineering, threat hunting and incident investigation using ELK Stack, Sysmon and Winlogbeat.

End-to-end threat intelligence pipeline built on internet-facing honeypots. Stage 1: log collection and analysis with ELK. Stage 2: 51 custom Wazuh detection rules mapped to MITRE ATT&CK, covering T-Pot and a Windows bait host. Stage 3: automated response (in progress).

Microsoft Sentinel KQL investigation of excessive Windows failed logon activity using Security Event ID 4625.

Multi-module phishing website detection tool

Cybersecurity lab demonstrating MITRE ATT&CK T1110 brute force attack simulation using Kali Linux and Hydra. Includes reconnaissance, attack execution, IoC analysis, and SOC defense strategies with Fail2Ban and 2FA implementation.

Week 2 SOC Internship – pfSense Firewall & pfBlockerNG Implementation

Python script that reads mock security logs, detects suspicious patterns (e.g., brute force, failed logins, blacklisted IPs), and raises alerts.

robotic security operations with more than just dashboards. This goes into dispatching and more. Meant for event / city security ops with experimental robotics to assist. Code sanitized as much to still show a demo.

A modular SIEM Log Analysis & Threat Detection Engine in Python. Parses Linux Auth, Web (Apache/Nginx), and Syslogs to detect brute-force attacks, SQLi/XSS web payloads, privilege escalations, and directory scanners in real-time or batch mode, exporting interactive HTML dashboard reports and JSON audits.

Sigma to MITRE ATT&CK detection pipeline with automated accuracy testing, covering endpoint and AWS CloudTrail telemetry.