Wazuh SIEM Dashboard

SECURITY INFORMATION & EVENT MANAGEMENT

Overview

Enterprise-grade SIEM platform simulating Wazuh/Splunk capabilities for real-time log analysis, threat detection, and compliance reporting.

Key Features

• Real-time log ingestion from multiple sources
• Threat correlation and event aggregation
• Brute force attack detection (5+ failed logins)
• SQL injection pattern recognition
• Privilege escalation detection (sudo patterns)
• Data exfiltration monitoring (sftp, scp, ssh)
• DDoS attack pattern detection (100+ connections)
• MITRE ATT&CK technique mapping
• Compliance scoring (GDPR, HIPAA, PCI-DSS, ISO27001)
• Executive compliance reports

Technologies

Python • Flask • SIEM Engine • Log Analysis • Threat Correlation • Compliance Scoring • MITRE ATT&CK

Detection Capabilities

Threat Correlation: Analyzes multiple events to detect complex attacks including brute force, SQL injection, privilege escalation, data exfiltration, DDoS, malware, and unauthorized access.

Real-Time Processing: Ingests logs, parses structured events, correlates threats, and generates alerts in real-time with severity classification.

Compliance Framework: Calculates compliance scores across GDPR, HIPAA, PCI-DSS, and ISO27001 standards with remediation recommendations.