Simple SIEM — Log Analyzer + Threat Dashboard

A small SIEM built for a 3-endpoint environment: a web server, a firewall/router, and an SSH authentication log source. A Python script parses and correlates suspicious activity across all three; a static HTML/CSS/JS dashboard visualizes the resulting alerts and malicious IPs.

siem_project/
├── logs/
│   ├── endpoint1_web_access.log     # sample nginx-style access log
│   ├── endpoint2_firewall.log       # sample SRC/DST/PORT/ACTION firewall log
│   └── endpoint3_auth.log           # sample sshd auth log
├── siem_analyzer.py                 # Part 1 — the analyzer
├── dashboard/
│   ├── index.html                   # Part 2 — the dashboard
│   ├── style.css
│   ├── script.js
│   ├── siem_report.json             # generated by siem_analyzer.py
│   └── data.js                      # generated by siem_analyzer.py (offline fallback)
├── README.md                        # this file
└── PUBLISH_TO_GHAYMAH.md            # Part 3 — publishing guide

Part 1 — `siem_analyzer.py`

Pure standard library, no pip install needed.

python3 siem_analyzer.py
# or point it at different files:
python3 siem_analyzer.py --logs-dir ./logs --out-dir ./dashboard

It parses all three log formats, runs the detection rules below, prints a console summary, and writes siem_report.json + data.js into dashboard/.

Detection rules

Rule	Source	Logic	Severity
`SQL_INJECTION` / `XSS` / `PATH_TRAVERSAL` / `COMMAND_INJECTION`	web	Regex signatures against the (URL-decoded) request path	critical/high
`RECON_SCANNER`	web	≥3 requests with a known scanner user-agent (sqlmap, nikto, nmap…)	medium
`HIGH_REQUEST_RATE`	web	≥15 requests from one IP within 60s	medium/high
`PORT_SCAN`	firewall	≥8 distinct destination ports from one IP within 120s	high
`BRUTE_FORCE_SSH`	auth	≥5 failed logins from one IP within 300s	high
`ACCOUNT_COMPROMISE_SUSPECTED`	auth	A successful login from an IP right after it triggered a brute-force alert	critical
`BLACKLISTED_IP_ACTIVITY`	any	IP matches a seeded threat-intel list	critical
`MULTI_VECTOR_ATTACK`	correlation	Same source IP triggered alerts on ≥2 different endpoints	critical

That last rule is the actual point of a SIEM: no single log tells the whole story, but seeing the same IP port-scan the firewall, brute-force SSH, and throw SQLi at the web app is what turns three noisy logs into one clear "this IP is attacking us" signal. All thresholds live in the THRESHOLDS dict at the top of the script if you want to tune them.

Part 2 — the dashboard

Open dashboard/index.html directly in a browser — it works out of the box because it falls back to the embedded data.js snapshot. For the "live" experience (auto re-fetching siem_report.json when you click Refresh), serve the folder instead:

cd dashboard
python3 -m http.server 8000
# open http://localhost:8000

What's on it:

Stat cards — total alerts and the severity breakdown.
Threat Radar — the top malicious IPs plotted by score (closer to center = more dangerous); a critical IP gets a pulsing ring.
Severity Mix — a proportional bar of critical/high/medium/low.
Top Malicious IPs — ranked list with a relative-score bar.
Alerts table — searchable, filterable by severity/endpoint; click a row to expand the raw log line(s) behind that alert.

Re-running siem_analyzer.py regenerates both output files — refresh the page (or click the in-app Refresh button if you're on a local server) to see updated results.

A note on why the table doesn't use `innerHTML`

Alert descriptions and evidence are literally attacker-supplied log text — some of the sample data contains a real <script> payload. script.js builds every row with createElement/textContent, never string-built HTML, so the console can't be XSS'd by the very payloads it's reporting on.

Regenerating with your own logs

Swap the three files in logs/ for real exports (keep the same filenames, or pass --logs-dir) and adjust the regexes in siem_analyzer.py if your log format differs from the nginx / iptables-style / sshd formats assumed here.

README.md