Latest posts

  • When Your Detection Fails… But It’s Actually Correct-Building a Fault-Tolerant SOC API

    When Your Detection Fails… But It’s Actually Correct I built a brute-force detection system based on Windows Event ID 4625 (failed logins). Everything looked correct:✔ Query worked✔ Elasticsearch returned data✔ API responded But… 📉 My “Top Attacker IPs” endpoint returned:[] At first, I thought my code was broken. It wasn’t. The real issue :All logs…

    Read more

  • Building a Mini SOC Dashboard from Scratch (Node.js + Nginx + Elasticsearch)

    Over the past few days, I built a lightweight SOC (Security Operations Center) dashboard from scratch — and honestly, it was a great hands-on experience dealing with real-world debugging, networking issues, and system integration. Here’s a breakdown of what I built and learned. Architecture Overview The system consists of: Step 1: Backend API (Node.js) I…

    Read more

  • Building an SOC & Incident Response Platform

    Over the past few days, I designed and implemented a custom Security Operations Center (SOC) platform integrating Elasticsearch, FastAPI, automated detection pipelines, and dynamic incident investigation workflows. The goal of this project was to move beyond static dashboards and build a real-world security operations architecture capable of ingesting alerts, detecting threats, correlating security events, and…

    Read more

  • Building a SOC Dashboard from Scratch

    The Real Journey (Not the Tutorial Version) After days of debugging, frustration, and small wins, I finally got my SOC Dashboard running end-to-end on a VPS using: But what made this valuable wasn’t the final result; it was the problems along the way. Here’s what actually happened behind the scenes 🔴 1. “It Works on…

    Read more

  • From Local Lab to a Public SOC API

    I just deployed my first SOC (Security Operations Center) backend to a live VPS and exposed it via a domain. Stack: What I built: Real challenges I faced (and solved): Key lessons: A working backend is not enough — real SOC systems depend heavily on data quality and log context. 🌐 Live API:http://api.mydomain Debugging a…

    Read more

  • Building a Real-Time SOC Platform from Scratch (Detection → Alerting → Visualization)

    I’ve been working on designing a lightweight SOC (Security Operations Center) platform that simulates real-world detection, alerting, and monitoring workflows. This project is not just a dashboard; it includes a full detection pipeline from log ingestion to incident visualization. Phase 1 – Detection Engine (Elasticsearch) I integrated the backend with Elasticsearch (Winlogbeat logs) and implemented…

    Read more

  • Building Smart Detection for a SOC System (Time-Based Threat Detection)

    Introduction After implementing basic brute-force detection and multi-channel alerting (Telegram + Email), I took the next step toward building a more realistic SOC system: Smart Detection. Instead of relying on simple thresholds, this phase introduces time-based analysis, making detection more accurate and closer to those found in real-world SIEM systems. ❌ The Problem with Simple…

    Read more

  • Building Real-Time Email Alerts for a SOC System (Elastic Stack + Node.js)

    Introduction In a modern Security Operations Center (SOC), detecting threats is not enough — timely notification is critical. While dashboards provide visibility, real-time alerting ensures immediate response to security incidents. In this phase of my project, I implemented multi-channel alerting (Telegram + Email) along with an anti-spam mechanism, transforming the system into a more realistic SOC solution.…

    Read more

  • Building Real-Time Telegram Alerts for a SOC Dashboard (Elastic Stack + Node.js)

    Introduction In modern Security Operations Centers (SOC), detecting threats is only half the battle — real-time alerting is what truly enables fast response. In this phase of my project, I extended my SOC dashboard by integrating Telegram alerts, allowing the system to notify me instantly whenever a brute-force attack is detected. Why Telegram Alerts? Traditional dashboards…

    Read more

  • Building a Real-Time SOC Dashboard with Elastic Stack, Node.js, and Chart.js

    Introduction In modern cybersecurity operations, detecting and visualizing suspicious activities in real time is critical. In this project, I developed a lightweight yet powerful Security Operations Center (SOC) dashboard that detects and visualizes brute-force login attempts in real-time using data from the Elastic Stack. This project demonstrates how to integrate ElasticSearch, Winlogbeat, Node.js, and Chart.js into…

    Read more