A centralized, web-based SOC platform for real-time threat monitoring, incident response, and security analytics.
- Overview
- Features
- Modules
- Tech Stack
- Getting Started
- Project Structure
- Screenshots
- SIEM Architecture
- Security Features
- Future Enhancements
- License
SecureSOC is a capstone project simulating a real-world Security Information and Event Management (SIEM) platform. It enables organizations to:
- Collect logs from firewalls, servers, endpoints, and web applications.
- Detect suspicious activities and cyber threats in real time.
- Investigate incidents through structured, multi-phase workflows.
- Respond efficiently with centralized case management and analyst collaboration.
- Report on security posture through automated, scheduled reports.
⚠️ This project uses mock/simulated data to demonstrate the SOC platform UI and workflows. Integration points for live SIEM tools (Wazuh, Suricata, Elasticsearch) are clearly marked in the Settings module.
| Feature | Description |
|---|---|
| 🔐 Authentication | Login page with demo RBAC roles (Super Admin, Analyst, Viewer) |
| 📊 Live Dashboard | Real-time KPI widgets, Chart.js visualizations, alert feeds |
| 🚨 Alert Management | Searchable alert stream with severity, status, and assignment |
| 🔥 Incident Response | 6-phase workflow: New → Investigation → Containment → Eradication → Recovery → Closed |
| 📁 Case Management | Alert-to-case promotion, evidence tracking, analyst notes, timeline |
| 🌍 Threat Intelligence | IOC registry (IPs, domains, hashes, URLs), confidence scoring, feed sync |
| 🖥️ Network Monitoring | Live traffic charts, top talkers, protocol distribution, active connections |
| 📜 Log Management | Centralized log stream from 10 source types with filtering and search |
| 🏷️ Asset Inventory | Full asset registry with health status, OS, department, and scan dates |
| 🐛 Vulnerability Management | CVE tracking, CVSS scoring, risk ratings, patch status |
| 📑 Reports | Executive, compliance, incident and vulnerability report templates |
| 🔍 Audit Logs | Immutable record of all user actions with role and IP tracking |
| 🔔 Notifications | In-app feed with multi-channel indicators (Email, SMS, In-App) |
| ⚙️ System Settings | Organization config, SIEM integration endpoints, security policies |
- Secure login form with show/hide password
- Role-Based Access Control (RBAC) — 6 predefined roles
- Demo credentials panel for testing
- Session management & MFA indicator
Widgets: Total Events, Active Alerts, Critical Incidents, Assets Online
Charts: Network Traffic (Line), Alert Severity (Doughnut), Top Attacks (Bar)
Table: Real-time critical alerts feed
Tracks: Servers, Routers, Switches, Firewalls, Workstations, Laptops, VMs, IoT
Fields: Name, IP, MAC, OS, Department, Status, Last Scan
Sources: Windows Event Logs, Linux Syslog, Firewall, IDS/IPS, VPN, DNS, DHCP, Web Server, Auth, DB
Functions: Search, filter by type & severity, real-time stream
Levels: Critical, High, Medium, Low, Informational
Features: Search, filter, assign, escalate, close
Workflow phases visualized with Kanban-style tracker
Fields: ID, Type, Severity, Status, Analyst, Timeline
IOC types: IPs, Domains, URLs, File Hashes, Emails, Malware Families
Features: IOC search, confidence scoring, threat feed integration panel
Views: 24h traffic chart, protocol pie chart, top talkers bar chart, active connections table
Fields: CVE ID, CVSS Score (with visual bar), Risk Rating, Affected Asset, Patch Status
Features: Create case from alert, assign analyst, evidence count, notes, case timeline panel
Templates: Executive, Compliance (ISO 27001), Vulnerability, Incident, Audit
Actions: Download PDF, filter by date range and type
Tracks: Login, Logout, Password Change, Alert Assignment, Incident Update, User Creation, Asset Modification, Report Generation
Channels: In-App, Email, SMS
Events: New Alert, Critical Incident, Failed Login, Device Offline, High CPU
Actions: Mark as read, dismiss, channel preferences
| Layer | Technology | Version |
|---|---|---|
| Framework | Next.js (App Router) | 16.2 |
| UI Components | Bootstrap | 5.x |
| Charts | Chart.js + react-chartjs-2 | 4.x |
| Icons | Lucide React | Latest |
| Language | JavaScript (ES2022) | - |
| Styling | Vanilla CSS with CSS Variables | - |
| Package Manager | npm | 11.x |
- Wazuh – Host-based Intrusion Detection System (HIDS)
- Suricata – Network Intrusion Detection System (NIDS)
- Elasticsearch – Log indexing and search
- Logstash – Log pipeline and parsing
- Kibana – Log visualization
- Filebeat / Winlogbeat – Log shipping agents
- Node.js v18 or higher → Download
- npm v9 or higher (comes with Node.js)
# 1. Clone the repository
git clone https://github.com/YOUR_USERNAME/SecureSOC.git
# 2. Navigate into the project directory
cd SecureSOC
# 3. Install dependencies
npm install
# 4. Start the development server
npm run devOpen http://localhost:3000 in your browser.
| Role | Password | |
|---|---|---|
| Super Administrator | admin@securesoc.com |
password |
| Security Analyst | analyst@securesoc.com |
password |
| Viewer | viewer@securesoc.com |
password |
SecureSOC/
├── public/ # Static assets
├── src/
│ ├── app/ # Next.js App Router pages
│ │ ├── page.js # 📊 Dashboard
│ │ ├── login/page.js # 🔐 Authentication
│ │ ├── alerts/page.js # 🚨 Alert Management
│ │ ├── incidents/page.js # 🔥 Incident Response
│ │ ├── cases/page.js # 📁 Case Management
│ │ ├── assets/page.js # 🖥️ Asset Inventory
│ │ ├── logs/page.js # 📜 Log Management
│ │ ├── network/page.js # 🔗 Network Monitoring
│ │ ├── threat-intel/page.js # 🌍 Threat Intelligence
│ │ ├── vulnerabilities/page.js # 🐛 Vulnerability Mgmt
│ │ ├── audit-logs/page.js # 🔍 Audit Logs
│ │ ├── notifications/page.js # 🔔 Notifications
│ │ ├── reports/page.js # 📑 Reports
│ │ ├── settings/page.js # ⚙️ System Settings
│ │ ├── layout.js # Root layout (Bootstrap CSS)
│ │ └── globals.css # Global CSS variables & styles
│ └── components/
│ └── layout/
│ └── DashboardLayout.js # Sidebar + Top Nav
├── .gitignore
├── next.config.mjs
├── package.json
└── README.md
Network Devices / Servers / Firewalls / Endpoints
│
▼
Log Collection Agents
(Winlogbeat / Filebeat)
│
▼
Logstash Pipeline
│
▼
Elasticsearch Index
│
▼
SecureSOC Dashboard (Next.js)
│
┌──────────────┼──────────────┐
▼ ▼ ▼
Alert Engine Incident Mgmt Reports
│
▼
Security Analysts
- ✅ Role-Based Access Control (RBAC) with 6 permission levels
- ✅ Audit logging for all platform actions
- ✅ Session management & account lockout simulation
- ✅ Input validation and XSS-safe rendering
- ✅ CSRF-safe architecture (Next.js built-in)
- 🔲 AES-256 encryption for sensitive stored data (planned)
- 🔲 Multi-Factor Authentication (MFA) (planned)
- 🔲 Rate limiting (planned)
- AI-powered anomaly detection using machine learning
- SOAR playbooks for automated incident response
- MITRE ATT&CK framework mapping
- VirusTotal, MISP, OpenCTI API integrations
- Compliance dashboards (ISO 27001, NIST, PCI DSS)
- Real-time WebSocket updates
- Mobile-responsive PWA for analysts on the go
- Cloud deployment (Vercel / AWS / Azure)
- MySQL/PostgreSQL database backend
- Full Wazuh, Suricata, ELK stack integration
Developed as a Final-Year Capstone Project
Network Engineering & Cybersecurity
This project simulates a real enterprise SOC environment demonstrating practical SIEM concepts including log aggregation, alert correlation, incident response workflows, and threat intelligence management.
This project is licensed under the MIT License – see the LICENSE file for details.
Made with ❤️ for Cybersecurity Education
⭐ Star this repo if you found it useful! ⭐