SIEM Security Analytics Demo
ELK Stack + MITRE ATT&CK
Developed SIEM platform demo showcasing modern security analytics using ELK stack (Elasticsearch, Logstash, Kibana). System ingests security logs from multiple sources (firewalls, IDS, endpoints) via Logstash, normalizes to ECS (Elastic Common Schema), indexes in Elasticsearch, analyzes via Kibana dashboards. Implements correlation rules for multi-stage attack detection, MITRE ATT&CK framework mapping, anomaly detection via Isolation Forest ML model. Demonstrates threat hunting workflows, compliance reporting, incident response automation with Python scripts.
The Challenge
SIEM requires ingesting logs from multiple sources (firewalls, IDS, endpoints), normalizing diverse formats, correlating events for threat detection. ELK stack complex setup. Security analytics needs MITRE ATT&CK mapping. Anomaly detection requires ML models. Compliance reporting needs structured dashboards. Alert fatigue from false positives.
The Solution
Built SIEM demo using ELK stack (Elasticsearch, Logstash, Kibana). Logstash ingests logs and normalizes to ECS. Correlation rules detect multi-stage attacks. Kibana dashboards map to MITRE ATT&CK techniques. Python Isolation Forest model for anomaly detection. Compliance reporting via Kibana visualizations. Demonstrates production SIEM patterns.
Technology Stack
Architecture
- Logstash ingestion pipelines with ECS normalization
- Elasticsearch indexing with optimized mappings
- Kibana dashboards: MITRE ATT&CK, attack timeline, geo heatmap
- Elastalert2 for correlation rules and alerting
- Python Isolation Forest model for anomaly detection
- Wazuh + Suricata log ingestion via Filebeat
- Compliance dashboards for PCI-DSS, HIPAA, SOC 2
- Python scripts for automated incident response
- Docker Compose deployment: ELK + Wazuh + Suricata
- Threat hunting with Elasticsearch saved searches
Key Features
Results & Impact
- ELK stack deployment: Elasticsearch 8.x, Logstash 8.x, Kibana 8.x
- Log normalization to ECS (Elastic Common Schema) format
- MITRE ATT&CK framework mapping for threat detection techniques
- Correlation rules detecting multi-stage attacks (e.g., brute force → privilege escalation)
- Isolation Forest ML model for anomaly detection with 85% precision
- Kibana dashboards: attack timeline, geo heatmap, MITRE coverage
- Tested with 10K+ simulated security events from Wazuh, Suricata
- Docker Compose deployment: Elasticsearch + Logstash + Kibana + Python