seim

A prototype GreyNoise integration for FluentBit with Lua scripts.

Notif360 is an open-source system monitoring and notification tool designed to provide comprehensive oversight of critical system metrics, website health, and malware scanning

Hands-on SOC lab built with Wazuh, Sysmon, Suricata, VirusTotal, and Chainsaw to simulate, detect, and investigate RDP-based intrusions through SIEM monitoring, threat hunting, and incident analysis.

Enterprise-style Wazuh SIEM homelab featuring Windows & Linux monitoring, Sysmon, Auditd, custom detections, threat hunting, incident response, and MITRE ATT&CK mapping.

Network Access Control (NAC) + Security Information and Event Management (SIEM) + Continuous Threat Exposure Management (CTEM)

This repository stores tables for use in SEIM tools (specifically Sumologic)

Splunk SIEM investigation lab with SPL detection rules, BOTS dataset analysis, and IR reports mapped to MITRE ATT&CK

A self built log monitoring and alerting tool. Parses SSH auth logs with Bash and Python to detect brute force attacks and privilege escalation, renders the findings in a custom JavaScript dashboard, and ships with Splunk SPL queries for SIEM style correlation.

AI-powered SOC alert triage pipeline. Wazuh → enrich → dedup → rules → LLM → Graylog.

First attempt at a lambda architecture SEIM using Power BI & Azure Sentinel

Readable, RFC-compliant plain-text email alerts for Wazuh. A drop-in replacement for wazuh-maild that fixes truncated subjects, malformed headers, and messages rejected by strict MTAs for exceeding the 998-octet line limit. Single Python file, no dependencies, no external config.

Basic Intrusion Detection System using Scapy

CTI Lab 2 — Malicious File Analysis, ELK Stack, Purple Teaming (MITRE ATT&CK), and Elastic SIEM Alerting exercises. Tools: Sysmon, Atomic Red Team, Kibana, VirusTotal.

Hands-on Wazuh SIEM deployment with Windows and Linux endpoints, File Integrity Monitoring (FIM), and Threat Hunting.

My SOC Level 1 study notes from TryHackMe. Covers threat intelligence, SIEM investigations, digital forensics, endpoint monitoring, and phishing analysis, with practical labs using tools like Splunk, Wireshark, Sysmon, and Volatility.

Security Event and Incident Management: A security software that helps recognize and address potential security threats and vulnerabilities.

Workaround to organisations lacking Enterprise Tier for GitHub SEIM logging

Personal SOC lab built on Wazuh + Suricata to practice detection engineering, alert triage, and incident investigation.

seim + idr without an api

Mini-SIEM is a lightweight, dark-themed security monitoring dashboard that simulates attacks, tracks incidents by severity, and helps you practice real-world SOC skills in Python.