New here? It is a security log dashboard full of made-up data, so click anything.
Timeline
Alerts per hour. Click a column to filter the list to that hour.
Alerts
| Selected | Rule | Alert |
|---|
No alerts match these filters. Press r to reset.
Incidents
Alerts that share a source IP, or a host and a time window, grouped into one story.
Top IPs
Worst severity first, then alert count. Click one to filter.
MITRE ATT&CK
Techniques seen in this data set, in kill-chain order. Click a row to filter the alerts.
| Tactic | Technique | Name | Alerts | Worst |
|---|
Detection rules (0) thresholds live in rules/detection_rules.json
| ID | Rule | Severity | Sources | ATT&CK | Thresholds |
|---|
Event tailreplay
A replay of the events behind the alerts, oldest first. It is not a live feed.
Why I built this
I'm a CS student in Toronto and I'm teaching myself forensics and security on the side. I kept reading that a SIEM "correlates logs" and I never really understood what that meant, so I wrote a small one to find out where it hurts.
The thing that surprised me most was brute force versus password spraying. I figured they'd look the same, since both are a pile of failed logins. They aren't. Brute force is one IP hammering a few accounts. Spraying is one IP trying a couple of passwords on lots of accounts. My first spray rule also fired during the first minute of a loud brute force, because early on every account had only been tried once or twice. I only noticed because I wrote a test that replays the attack. The fix was to judge the whole attack instead of the ramp-up.
What I'd improve: every log here is fake and written by me, so 12 out of 12 only proves the rules do what I told them to. I want to try it on logs from a throwaway VM I control. It also needs a per-user idea of normal instead of fixed office hours, proper timezone handling, and a way to catch slow attacks, because a few tries an hour walks right past it.
The event tail is a replay of the synthetic events, not a live feed. I just like how it feels to watch.
Portfolio project by Diogo Ramos. Detection is rule-based and I only tested it on synthetic data I generated, so treat it as a learning project and not a real SIEM. Timestamps are shown as written in the logs, with no timezone conversion.