seim

A prototype GreyNoise integration for FluentBit with Lua scripts.

Hands-on SOC lab built with Wazuh, Sysmon, Suricata, VirusTotal, and Chainsaw to simulate, detect, and investigate RDP-based intrusions through SIEM monitoring, threat hunting, and incident analysis.

Notif360 is an open-source system monitoring and notification tool designed to provide comprehensive oversight of critical system metrics, website health, and malware scanning

Enterprise-style Wazuh SIEM homelab featuring Windows & Linux monitoring, Sysmon, Auditd, custom detections, threat hunting, incident response, and MITRE ATT&CK mapping.

Network Access Control (NAC) + Security Information and Event Management (SIEM) + Continuous Threat Exposure Management (CTEM)

Sigma rules creation and deployment for threat detection using Wazuh SIEM. Includes Sigma YAML rules, automated Sigma-to-Wazuh XML conversion, MITRE ATT&CK mapping, and real-world PoC validation.

This repository stores tables for use in SEIM tools (specifically Sumologic)

Malware Analysis Lab using Wazuh & Sysmon for endpoint monitoring, threat hunting, MITRE ATT&CK mapping, and incident analysis.

Evidence-first, SIEM-agnostic AI security alert triage & investigation engine. Ingests alerts from multiple SIEM/EDR sources, deduplicates and correlates them into incidents, and produces explainable, evidence-backed AI analysis mapped to MITRE ATT&CK.

Splunk SIEM investigation lab with SPL detection rules, BOTS dataset analysis, and IR reports mapped to MITRE ATT&CK

Readable, RFC-compliant plain-text email alerts for Wazuh. A drop-in replacement for wazuh-maild that fixes truncated subjects, malformed headers, and messages rejected by strict MTAs for exceeding the 998-octet line limit. Single Python file, no dependencies, no external config.

AI-powered SOC alert triage pipeline. Wazuh → enrich → dedup → rules → LLM → Graylog.

Educational Wazuh SOC home lab for security monitoring, alert triage, log analysis, incident response and CTI enrichment.

Basic Intrusion Detection System using Scapy

Hands-on Wazuh SIEM deployment with Windows and Linux endpoints, File Integrity Monitoring (FIM), and Threat Hunting.

A self built log monitoring and alerting tool. Parses SSH auth logs with Bash and Python to detect brute force attacks and privilege escalation, renders the findings in a custom JavaScript dashboard, and ships with Splunk SPL queries for SIEM style correlation.

My SOC Level 1 study notes from TryHackMe. Covers threat intelligence, SIEM investigations, digital forensics, endpoint monitoring, and phishing analysis, with practical labs using tools like Splunk, Wireshark, Sysmon, and Volatility.

CTI Lab 2 — Malicious File Analysis, ELK Stack, Purple Teaming (MITRE ATT&CK), and Elastic SIEM Alerting exercises. Tools: Sysmon, Atomic Red Team, Kibana, VirusTotal.

Mini-SIEM is a lightweight, dark-themed security monitoring dashboard that simulates attacks, tracks incidents by severity, and helps you practice real-world SOC skills in Python.

seim + idr without an api