Cloud SOC Lab
A security operations center (SOC) lab where network intrusion alerts are collected, stored and triaged in one dashboard. It's an ongoing project. The first milestone, the alert pipeline and dashboard, is done.
- Designed one alert model that normalizes events from Suricata and Zeek: severity, signature, source and destination IP and port, protocol, attack category (scan, brute force, web attack, DNS, malware) and the raw log.
- Added an analyst workflow to every alert: new, investigating, closed or false positive, with investigation notes.
- Built a REST API in Express and MongoDB to list, view and create alerts, plus an ingest job that loads seeded alerts such as an Nmap SYN scan.
- Built a React dashboard that shows alerts newest first, with severity, signature, IPs, category and status.
Node.jsExpressMongoDBReactViteSuricataZeekSOC workflow
View code on GitHub Open source