seim

A prototype GreyNoise integration for FluentBit with Lua scripts.

Notif360 is an open-source system monitoring and notification tool designed to provide comprehensive oversight of critical system metrics, website health, and malware scanning

Enterprise-style Wazuh SIEM homelab featuring Windows & Linux monitoring, Sysmon, Auditd, custom detections, threat hunting, incident response, and MITRE ATT&CK mapping.

Network Access Control (NAC) + Security Information and Event Management (SIEM) + Continuous Threat Exposure Management (CTEM)

Hands-on SOC lab built with Wazuh, Sysmon, Suricata, VirusTotal, and Chainsaw to simulate, detect, and investigate RDP-based intrusions through SIEM monitoring, threat hunting, and incident analysis.

Splunk SIEM investigation lab with SPL detection rules, BOTS dataset analysis, and IR reports mapped to MITRE ATT&CK

Evidence-first, SIEM-agnostic AI security alert triage & investigation engine. Ingests alerts from multiple SIEM/EDR sources, deduplicates and correlates them into incidents, and produces explainable, evidence-backed AI analysis mapped to MITRE ATT&CK.

This repository stores tables for use in SEIM tools (specifically Sumologic)

Malware Analysis Lab using Wazuh & Sysmon for endpoint monitoring, threat hunting, MITRE ATT&CK mapping, and incident analysis.

AI-powered SOC alert triage pipeline. Wazuh → enrich → dedup → rules → LLM → Graylog.

My SOC Level 1 study notes from TryHackMe. Covers threat intelligence, SIEM investigations, digital forensics, endpoint monitoring, and phishing analysis, with practical labs using tools like Splunk, Wireshark, Sysmon, and Volatility.

Hands-on Wazuh SIEM deployment with Windows and Linux endpoints, File Integrity Monitoring (FIM), and Threat Hunting.

Educational Wazuh SOC home lab for security monitoring, alert triage, log analysis, incident response and CTI enrichment.

A self built log monitoring and alerting tool. Parses SSH auth logs with Bash and Python to detect brute force attacks and privilege escalation, renders the findings in a custom JavaScript dashboard, and ships with Splunk SPL queries for SIEM style correlation.

Readable, RFC-compliant plain-text email alerts for Wazuh. A drop-in replacement for wazuh-maild that fixes truncated subjects, malformed headers, and messages rejected by strict MTAs for exceeding the 998-octet line limit. Single Python file, no dependencies, no external config.

CTI Lab 2 — Malicious File Analysis, ELK Stack, Purple Teaming (MITRE ATT&CK), and Elastic SIEM Alerting exercises. Tools: Sysmon, Atomic Red Team, Kibana, VirusTotal.

First attempt at a lambda architecture SEIM using Power BI & Azure Sentinel

Basic Intrusion Detection System using Scapy

Personal SOC lab built on Wazuh + Suricata to practice detection engineering, alert triage, and incident investigation.

Installed and configured Splunk Enterprise, created a SOC Lab index, and prepared a SIEM environment for future log ingestion and security investigations.