A lightweight Security Operations Centre (SOC) platform that detects, analyzes, and visualizes cyber threats using a combination of rule-based detection and machine learning.
Mini SIEM simulates a real-world SOC environment where security analysts monitor logs, detect anomalies, and investigate threats. The system processes multiple cybersecurity datasets, applies detection logic, and presents insights through an interactive dashboard.
- 🔍 Rule-based threat detection (SQLi, XSS, DDoS, etc.)
- 🤖 Machine learning anomaly detection (Isolation Forest + LOF)
- 🧠 SHAP-based explainability for model decisions
- 🗂 SQLite database for alert storage
- 📊 Interactive Streamlit dashboard (SOC-style UI)
- 🧑💻 Analyst workbench for investigation and alert management hello hey
Raw Data → Cleaning → Rule Detection → ML Models → Explainability → Database → Dashboard
- Language: Python
- Data Processing: Pandas, NumPy
- Machine Learning: Scikit-learn
- Explainability: SHAP
- Database: SQLite
- Frontend: Streamlit
- Visualization: Plotly
mini-siem/
├── dashboard/ # Streamlit dashboard
├── src/ # Core logic (cleaning, detection, ML, DB)
├── pipeline.py # Main pipeline
├── requirements.txt
└── README.md
# Create virtual environment
python -m venv .venv
# Activate
.venv\Scripts\activate
# Install dependencies
pip install -r requirements.txt
# Run pipeline
python pipeline.py --clean
# Launch dashboard
streamlit run dashboard/app.pyDue to large dataset sizes, raw and processed data files are not included in this repository.
- Designed and developed the SOC dashboard using Streamlit
- Implemented alert visualization and filtering system
- Integrated SQLite database with frontend
- Built analyst workflow interface for alert investigation
- Real-time log ingestion (Kafka / APIs)
- User authentication system
- Cloud deployment with scalable backend
This project can be deployed using Streamlit Cloud:
- Push code to GitHub
- Go to https://share.streamlit.io
- Connect your repository
- Set entry point:
dashboard/app.py - Deploy
A practical implementation of a SIEM system demonstrating cybersecurity analytics, anomaly detection, and SOC workflows.