Threat-informed defense for cloudnative: Reference Implementation of a so-called Honeycluster - The detection capabilities can also be used as a SOC

This repository hold a complete step by step documentation of the creation of a Security Operations Center SOC home lab.

A hands-on SOC Automation Lab built using Wazuh, TheHive, Cortex, and ELK. Demonstrates real-time threat detection, alert forwarding, and automated incident response in a simulated enterprise environment.

Agentic Physical Security Platform- Edge AI

An Open-source Ready SOC in a dockerized environment

A toolkit for SOC, NOC, Linux, Windows, IR, and ops work.

Cybersecurity testing and research lab

AI-powered SOC pipeline with triage, investigation, and response agents

This detection engineering repo is for the Detection as Code CI/CD pipeline

Sysmon-based detection engineering lab for MITRE T1059.001 (encoded PowerShell) and T1055 (abnormal parent-child process chains) on Windows 11.

Multi-module phishing website detection tool

A Security Operations Center (SOC) Home Lab showcasing endpoint telemetry collection, detection engineering, threat hunting and incident investigation using ELK Stack, Sysmon and Winlogbeat.

Cybersecurity lab demonstrating MITRE ATT&CK T1110 brute force attack simulation using Kali Linux and Hydra. Includes reconnaissance, attack execution, IoC analysis, and SOC defense strategies with Fail2Ban and 2FA implementation.

Week 2 SOC Internship – pfSense Firewall & pfBlockerNG Implementation

Security log analysis engine - parses syslog, auth, Apache, and Windows event logs for threats

Python script that reads mock security logs, detects suspicious patterns (e.g., brute force, failed logins, blacklisted IPs), and raises alerts.

robotic security operations with more than just dashboards. This goes into dispatching and more. Meant for event / city security ops with experimental robotics to assist. Code sanitized as much to still show a demo.

Live SDN monitoring dashboard — POX + Mininet + React.js

A modular SIEM Log Analysis & Threat Detection Engine in Python. Parses Linux Auth, Web (Apache/Nginx), and Syslogs to detect brute-force attacks, SQLi/XSS web payloads, privilege escalations, and directory scanners in real-time or batch mode, exporting interactive HTML dashboard reports and JSON audits.

SOC Projects | Web Security | Networking