Ziad_Abdelgwad/cumin-soc
1
0
نسخ 0
الشفرة المشكلات طلبات السحب Actions Packages المشاريع الإصدارات الويكي النشاط

docs: Professional README + cleanup old files

تصفح المصدر 
- Rewrote README with badges, architecture diagram, quick start, MCP guide

- Deleted: cumin_evaluation_report_en.md, soc_system_report.md, walkthrough.md
هذا الالتزام موجود في:
Ziad Abdelgwad
2026-09-14 20:54:55 +03:00
الأصل d8ac07cb6f
التزام e29d5703c1
5 ملفات معدلة مع 225 إضافات و314 حذوفات
تنزيل ملف التصحيح تنزيل ملف الاختلاف توسيع جميع الملفات طي جميع الملفات

304
README.md
عرض الملف

@@ -1,109 +1,251 @@
# SOC Command Center on Cumin
<div align="center">
A full **Security Operations Center (SOC)** platform deployed on [Cumin](https://cumin.dev) — a cloud platform for deploying containerized applications via MCP (Model Context Protocol).
# 🛡️ SOC Command Center
## Architecture
**A Next-Generation Security Operations Center deployed on [Cumin](https://cumin.dev)**
[![Live Demo](https://img.shields.io/badge/Live%20Demo-Online-22c55e?style=for-the-badge&logo=googlechrome)](https://soc-gateway-http-e83c51cb.hosted.cumin.dev)
[![Platform](https://img.shields.io/badge/Platform-Cumin%20Cloud-6366f1?style=for-the-badge)](https://cumin.dev)
[![Runtime](https://img.shields.io/badge/Runtime-Node.js%2022-339933?style=for-the-badge&logo=nodedotjs)](https://nodejs.org)
[![Protocol](https://img.shields.io/badge/API-MCP%20Protocol-818cf8?style=for-the-badge)](https://modelcontextprotocol.io)
*Built entirely by an AI agent using the Cumin MCP API — a case study in AI-driven infrastructure deployment.*
</div>
---
## 📌 Overview
This repository contains a fully deployed, production-grade **Security Operations Center (SOC)** platform built as a case study for evaluating the **Cumin cloud platform**. The entire system — from architecture design to deployment — was orchestrated by an AI agent using Cumin's native [Model Context Protocol (MCP)](https://modelcontextprotocol.io) API.
**9 security services run as a single consolidated backend**, exposing a unified dashboard accessible publicly over HTTPS with zero manual infrastructure management.
| | |
|---|---|
| **Live URL** | https://soc-gateway-http-e83c51cb.hosted.cumin.dev |
| **Platform** | Cumin Cloud (`cumin.dev`) |
| **Total Apps Deployed** | 2 (backend + gateway) |
| **Services Simulated** | 9 SOC microservices |
| **Real Data** | Live HTTP security header scanning |
| **Full Report** | [`docs/REPORT.md`](./docs/REPORT.md) |
---
## 🏗️ Architecture
```
┌─────────────────────────────────────────────────┐
│ Internet │
│ │ │
│ ┌──────────▼──────────┐ │
│ │ soc-gateway │ │
│ │ (Dashboard UI) │ │
│ │ Port 3000 │ │
│ └──────────┬──────────┘ │
│ │ /proxy/* │
│ ┌──────────▼──────────┐ │
│ │ soc-backend │ │
│ │ (All 9 Services) │ │
│ │ Port 4000 │ │
│ │ │ │
│ │ ┌─── SIEM ───┐ │ │
│ │ ├─── SOAR ───┤ │ │
│ │ ├── Honeypot ─┤ │ │
│ │ ├── IDS/IPS ──┤ │ │
│ │ ├── Firewall ─┤ │ │
│ │ ├──── UBA ────┤ │ │
│ │ ├─ Threat Intel┤ │ │
│ │ ├─ Vuln Scan ──┤ │ │
│ │ └── Incidents ─┘ │ │
│ └─────────────────────┘ │
│ Cumin Cloud │
└─────────────────────────────────────────────────┘
┌─────────────────────────────────────────────────────────────────┐
│ 🌍 Public Internet │
│ │ HTTPS │
│ ┌──────────▼──────────┐ │
│ │ soc-gateway │ 150m CPU / 250MB │
│ │ Dashboard UI │ │
│ │ /proxy/* → backend │ │
│ └──────────┬──────────┘ │
│ │ HTTP │
│ ┌──────────▼──────────┐ │
│ │ soc-backend │ 250m CPU / 512MB │
│ │ │ │
│ ┌────────────────┤ Ingestion Layer ├─────────────────┐ │
│ │ 🔥 Firewall │ 📋 SIEM │ 🍯 Honeypot │ │
│ └────────────────┤ ├─────────────────┘ │
│ ┌────────────────┤ Analysis Layer ├─────────────────┐ │
│ │ 👤 UBA │ 🌐 Threat Intel │ 🛡️ IDS/IPS │ │
│ └────────────────┤ ├─────────────────┘ │
│ ┌────────────────┤ Operations Layer ├─────────────────┐ │
│ │ ⚡ SOAR │ 🚨 Incidents │ 🔍 Vuln Scan* │ │
│ └────────────────┴──────────────────────┴─────────────────┘ │
│ Cumin Cloud │
└─────────────────────────────────────────────────────────────────┘
* Vuln Scanner fetches REAL data from google.com, github.com, cloudflare.com
```
## Services
---
| Service | Role | Description |
|---------|------|-------------|
| **SIEM** | Log Collection | Collects and correlates security events from multiple sources |
| **SOAR** | Orchestration | Automates security responses via playbooks |
| **Honeypot** | Deception | Deploys traps to detect and track attackers |
| **IDS/IPS** | Detection | Identifies and blocks intrusion attempts |
| **Firewall** | Traffic Control | Manages network traffic rules and blocks threats |
| **UBA** | Behavior Analytics | Detects anomalous user behavior patterns |
| **Threat Intel** | IOC Feeds | Aggregates threat intelligence from multiple sources |
| **Vuln Scanner** | Assessment | **Real-time** scanning of actual websites for security headers |
| **Incidents** | Management | Tracks and manages security incidents end-to-end |
## 🔒 Services
## Real Target Monitoring
| Service | Role | Data Type |
|---------|------|-----------|
| 📋 **SIEM** | Log collection & event correlation | Simulated |
| ⚡ **SOAR** | Security orchestration & playbooks | Simulated |
| 🍯 **Honeypot** | Attacker deception & interaction tracking | Simulated |
| 🛡️ **IDS/IPS** | Intrusion detection & blocking | Simulated |
| 🔥 **Firewall** | Network traffic control & logging | Simulated |
| 👤 **UBA** | User behavior analytics & anomaly detection | Simulated |
| 🌐 **Threat Intel** | IOC feeds & threat intelligence | Simulated |
| 🔍 **Vuln Scanner** | HTTP security header auditing | ✅ **Real** |
| 🚨 **Incidents** | Case management & incident response | Simulated |
The Vulnerability Scanner performs **actual HTTP security header checks** against real websites:
- Google, GitHub, Cloudflare (external targets)
- Self-monitoring of the SOC backend
> **Note on Real Data:** The Vulnerability Scanner sends actual HTTP requests to public websites every 60 seconds and checks for the presence of 7 security headers (`CSP`, `HSTS`, `X-Frame-Options`, `X-Content-Type-Options`, `Referrer-Policy`, `Permissions-Policy`, `X-XSS-Protection`), computing a live compliance score.
It checks for: `Content-Security-Policy`, `X-Frame-Options`, `X-Content-Type-Options`, `Strict-Transport-Security`, `X-XSS-Protection`, `Referrer-Policy`, `Permissions-Policy`
---
## Project Structure
```
cumin/
├── src/
│ ├── backend.js # Combined backend (9 services + real scanning)
│ └── gateway.js # Dashboard UI server
├── scripts/
│ ├── deploy.js # Deploy both apps to Cumin
│ └── cleanup.js # Delete all apps from project
├── .gitignore
└── README.md
```
## Deployment
## 🚀 Deploy Your Own
### Prerequisites
- Node.js 18+
- A Cumin account with API token
- A [Cumin](https://cumin.dev) account with an API token and Project ID
### 1. Clone & Configure
```bash
git clone https://github.com/YOUR_USERNAME/cumin-soc.git
cd cumin-soc
```
Edit `scripts/deploy.js` and update:
```javascript
const CUMIN_TOKEN = "cumin_your_token_here";
const PROJECT_ID = "your-project-uuid";
```
### 2. Deploy
### Deploy
```bash
node scripts/deploy.js
```
### Cleanup
This will:
1. ✅ Delete any existing SOC apps in the project
2. ✅ Deploy `soc-backend` (all 9 services, real vulnerability scanning)
3. ✅ Wait for backend to boot and capture its public URL
4. ✅ Deploy `soc-gateway` (dashboard) pre-configured to proxy to the backend
5. ✅ Print the final live URLs
**Expected output:**
```
═══ SOC PLATFORM DEPLOY ═══
✅ MCP connected
🧹 Cleaning old apps...
📦 Deploying soc-backend...
✅ Backend ID: bbb0d30a-xxxx
Backend: running → https://soc-backend-http-xxxxxxxx.hosted.cumin.dev
🌐 Deploying soc-gateway...
✅ Gateway ID: f32ce529-xxxx
═══ FINAL STATUS ═══
🟢 soc-backend: running → https://soc-backend-http-xxxxxxxx.hosted.cumin.dev
🟢 soc-gateway: running → https://soc-gateway-http-xxxxxxxx.hosted.cumin.dev
```
### 3. Cleanup
```bash
node scripts/cleanup.js
```
## Tech Stack
---
- **Runtime**: Node.js 22 (Alpine)
- **Platform**: Cumin Cloud (cumin.dev)
- **Protocol**: MCP (Model Context Protocol)
- **Frontend**: Vanilla HTML/CSS/JS with Inter font
- **Design**: Dark theme, glassmorphism cards
## 🔑 How It Works: MCP Protocol
## Configuration
The deployment uses Cumin's **Model Context Protocol (MCP)** API — a JSON-RPC 2.0 interface designed for AI-agent consumption.
| Variable | Value | Description |
|----------|-------|-------------|
| `PROJECT_ID` | `178bfad9-...` | Cumin project identifier |
| `CUMIN_TOKEN` | `cumin_...` | API authentication token |
| Backend CPU | 250m | Backend resource allocation |
| Backend RAM | 512MB | Backend memory limit |
| Gateway CPU | 150m | Gateway resource allocation |
| Gateway RAM | 250MB | Gateway memory limit |
```javascript
// 1. Initialize session
const res = await fetch("https://api.cumin.dev/mcp", {
method: "POST",
headers: { "Authorization": `Bearer ${TOKEN}` },
body: JSON.stringify({
jsonrpc: "2.0",
method: "initialize",
id: 1,
params: { protocolVersion: "2024-11-05", clientInfo: { name: "deployer" } }
})
});
const SESSION_ID = res.headers.get("Mcp-Session-Id");
## License
// 2. Deploy an app
await fetch("https://api.cumin.dev/mcp", {
method: "POST",
headers: {
"Authorization": `Bearer ${TOKEN}`,
"Mcp-Session-Id": SESSION_ID
},
body: JSON.stringify({
jsonrpc: "2.0",
method: "tools/call",
id: 2,
params: {
name: "create_app",
arguments: {
project_id: PROJECT_ID,
name: "my-app",
image: "node:22-alpine",
cpu: 150, memory: 250,
ports: [{ name: "http", number: 3000, health: { path: "/health" } }],
args: ["node", "server.js"]
}
}
})
});
```
MIT
**Key trick — Code Injection (no Docker build needed):**
```javascript
// Base64-encode your app code and inject it as an env variable
// This deploys in seconds with zero Docker infrastructure
env: [{ name: "APP_CODE_B64", value: Buffer.from(code).toString("base64") }],
args: ["sh", "-c", "echo $APP_CODE_B64 | base64 -d > /app.js && node /app.js"]
```
---
## ⚡ Resource Requirements
| Resource | Minimum (Free Tier) | This Project |
|----------|--------------------|----|
| CPU | **150 millicores** | 400m total |
| RAM | **250 MB** | 762MB total |
| Apps | 10 max | 2 apps |
> **Important:** Setting CPU < 150m or RAM < 250MB causes a permanent `pending` state. The Cumin scheduler will never allocate resources below the platform minimums.
---
## 📁 Repository Structure
```
cumin/
├── 📄 README.md ← You are here
├── 📄 .gitignore
│
├── 📁 src/
│ ├── 📄 backend.js ← All 9 SOC services + real scanner (15.9KB)
│ └── 📄 gateway.js ← Dashboard UI + reverse proxy (19.4KB)
│
├── 📁 scripts/
│ ├── 📄 deploy.js ← Full MCP-based deployment automation
│ └── 📄 cleanup.js ← Delete all project apps
│
└── 📁 docs/
└── 📄 REPORT.md ← Comprehensive platform evaluation report
```
---
## 📊 Platform Evaluation Summary
For the full evaluation with Mermaid diagrams, code examples, live results, and detailed scoring → **[docs/REPORT.md](./docs/REPORT.md)**
| Feature | Score |
|---------|-------|
| 🚀 App Deployment | **9.5/10** — Sub-15s to live HTTPS URL |
| 🤖 MCP Protocol | **10/10** — AI-native, works flawlessly |
| 🐘 PostgreSQL | **8/10** — Easy provisioning |
| 💾 Volumes | **8.5/10** — Reliable persistent storage |
| 🪣 S3 Buckets | **8.5/10** — S3-compatible, instant |
| 🔐 Secrets | **4/10** — 403 on standard token |
| 🌐 Constellations | **3/10** — 403 on standard token |
| 💻 Developer Experience | **8.5/10** — Clean UI, great DX |
| **Overall** | **7.8 / 10** |
---
## 📄 License
MIT © 2026