Latest posts

  • Building a Real-Time SOC Platform from Scratch (Detection → Alerting → Visualization)

    I’ve been working on designing a lightweight SOC (Security Operations Center) platform that simulates real-world detection, alerting, and monitoring workflows. This project is not just a dashboard; it includes a full detection pipeline from log ingestion to incident visualization. Phase 1 – Detection Engine (Elasticsearch) I integrated the backend with Elasticsearch (Winlogbeat logs) and implemented…

    Read more

  • Building Smart Detection for a SOC System (Time-Based Threat Detection)

    Introduction After implementing basic brute-force detection and multi-channel alerting (Telegram + Email), I took the next step toward building a more realistic SOC system: Smart Detection. Instead of relying on simple thresholds, this phase introduces time-based analysis, making detection more accurate and closer to those found in real-world SIEM systems. ❌ The Problem with Simple…

    Read more

  • Building Real-Time Email Alerts for a SOC System (Elastic Stack + Node.js)

    Introduction In a modern Security Operations Center (SOC), detecting threats is not enough — timely notification is critical. While dashboards provide visibility, real-time alerting ensures immediate response to security incidents. In this phase of my project, I implemented multi-channel alerting (Telegram + Email) along with an anti-spam mechanism, transforming the system into a more realistic SOC solution.…

    Read more

  • Building Real-Time Telegram Alerts for a SOC Dashboard (Elastic Stack + Node.js)

    Introduction In modern Security Operations Centers (SOC), detecting threats is only half the battle — real-time alerting is what truly enables fast response. In this phase of my project, I extended my SOC dashboard by integrating Telegram alerts, allowing the system to notify me instantly whenever a brute-force attack is detected. Why Telegram Alerts? Traditional dashboards…

    Read more

  • Building a Real-Time SOC Dashboard with Elastic Stack, Node.js, and Chart.js

    Introduction In modern cybersecurity operations, detecting and visualizing suspicious activities in real time is critical. In this project, I developed a lightweight yet powerful Security Operations Center (SOC) dashboard that detects and visualizes brute-force login attempts in real-time using data from the Elastic Stack. This project demonstrates how to integrate ElasticSearch, Winlogbeat, Node.js, and Chart.js into…

    Read more

  • Building a Real SOC Dashboard with Elasticsearch & Node.js

    After successfully implementing log collection and visualization using Kibana, the next phase of my project focused on building a custom real-time SOC dashboard. The goal was to move beyond static analysis and create a system capable of live monitoring, detection, and visualization of security events. Project Objective The main objective was to design a dashboard…

    Read more

  • Building a Log Analysis Dashboard with Elasticsearch & Kibana

    In this phase of the project, I focused on collecting, visualizing, and understanding Windows security logs using the Elastic Stack (Elasticsearch, Kibana, and Winlogbeat). Log Collection with Winlogbeat The first step was to configure Winlogbeat on a Windows machine to collect system and security logs. These logs were then forwarded to Elasticsearch, where they were indexed…

    Read more

  • Building a Home SASE Lab with EVE-NG

    Step 1: Installing EVE-NG on VMware Step 2: Accessing EVE-NG Web Interface Step 3: Adding First Node (VPCS) Step 4: Connecting and Testing Nodes Step 5: Adding a Cisco Router Final Result Conclusion This setup provides a powerful and flexible environment for hands-on practice in networking and cybersecurity. By combining virtualization and real network images,…

    Read more

  • Building a Node.js Log Analysis & Detection Server

    Building a Mini SOC with Node.js & Elasticsearch I’ve been working on a hands-on project to simulate a basic Security Operations Center (SOC) environment using real log data. In this project: The system automatically identifies suspicious activity when multiple failed login attempts are detected from the same source. Example API endpoints: This project helped me…

    Read more

  • IBM Cloud Object Storage

    Store data in any format, anywhere, with scalability, resilience and security IBM Cloud® Object Storage is a highly scalable and resilient object storage service on IBM Cloud, helping to ensure security, compliance, data availability, and performance. With built-in encryption, multi-region support, and seamless integration with the powerful IBM Cloud ecosystem, it’s the perfect foundation for…

    Read more