Latest posts
-
ELK Stack Setup (Windows + Winlogbeat + Kibana)
A complete solution for log management, security monitoring, and real-time analytics 1. Start Elasticsearch Verify: š http://localhost:9200 2. Start Kibana cd C:\kibana-9.3.2\bin .\kibana.bat 3. Fix Kibana Authentication In kibana.yml: elasticsearch.hosts: [“http://localhost:9200”] elasticsearch.username: “kibana_system” elasticsearch.password: “<your-password>” 4. Configure Winlogbeat Edit winlogbeat.yml: winlogbeat.event_logs: – name: Application – name: System – name: Security output.elasticsearch: hosts: [“http://localhost:9200”] username: “elastic”…
-
When Your Detection Fails⦠But Itās Actually Correct-Building a Fault-Tolerant SOC API
When Your Detection Fails⦠But Itās Actually Correct I built a brute-force detection system based on Windows Event ID 4625 (failed logins). Everything looked correct:ā Query workedā Elasticsearch returned dataā API responded But⦠š My āTop Attacker IPsā endpoint returned:[] At first, I thought my code was broken. It wasnāt. The real issue :All logs…
-
Modern Adversarial Attacks in Deep Learning: Methods, Trends, and Challenges
Introduction Adversarial examples are carefully perturbed inputs designed to mislead machine learning models while remaining nearly indistinguishable to humans. Over the past decade, research in adversarial machine learning has evolved from simple gradient-based perturbations to sophisticated, real-world attack strategies that challenge even state-of-the-art models. This article provides a scientific overview of modern adversarial attack methods,…
-
Securing Data Science Systems: Why Small Changes Can Have Big Consequences
Data science and artificial intelligence are transforming how we conduct research and make decisions. From academic environments to real-world systems, we rely heavily on data-driven models. But there is a fundamental question we often ignore: Can we truly trust these systems? The Hidden Problem: Small Changes, Big Impact One of the most overlooked challenges in…
-
Adversarial Perturbation (Python)
simple code āHere, we added a very small perturbation to the image. For humans, the image looks almost the same, but for an AI model, this small change can completely alter the prediction.ā āThis shows that AI systems can be very sensitive to small, almost invisible changes.ā
-
Adversarial Weakness Analysis (AWA)
Adversarial Weakness Analysis (AWA) Simple definition: Adversarial Weakness Analysis is the process of identifying and analyzing how AI and machine learning systems can be fooled by small, intentional changes in input data, and how to make them more robust against such attacks. Core idea (in simple terms) AI systems can sometimes make completely wrong decisions when the…
-
Building a Mini SOC Dashboard from Scratch (Node.js + Nginx + Elasticsearch)
Over the past few days, I built a lightweight SOC (Security Operations Center) dashboard from scratch ā and honestly, it was a great hands-on experience dealing with real-world debugging, networking issues, and system integration. Hereās a breakdown of what I built and learned. Architecture Overview The system consists of: Step 1: Backend API (Node.js) I…
-
Building an SOC & Incident Response Platform
Over the past few days, I designed and implemented a custom Security Operations Center (SOC) platform integrating Elasticsearch, FastAPI, automated detection pipelines, and dynamic incident investigation workflows. The goal of this project was to move beyond static dashboards and build a real-world security operations architecture capable of ingesting alerts, detecting threats, correlating security events, and…
-
Building a SOC Dashboard from Scratch
The Real Journey (Not the Tutorial Version) After days of debugging, frustration, and small wins, I finally got my SOC Dashboard running end-to-end on a VPS using: But what made this valuable wasnāt the final result; it was the problems along the way. Hereās what actually happened behind the scenes š“ 1. āIt Works on…
-
From Local Lab to a Public SOC API
I just deployed my first SOC (Security Operations Center) backend to a live VPS and exposed it via a domain. Stack: What I built: Real challenges I faced (and solved): Key lessons: A working backend is not enough ā real SOC systems depend heavily on data quality and log context. š Live API:http://api.mydomain Debugging a…