Ziad Abdelgwad
3566d9c86a
9-service SOC platform deployed on Cumin via MCP Features: SIEM, SOAR, Honeypot, IDS/IPS, Firewall, UBA, Threat Intel, Vuln Scanner (real targets), Incident Management Architecture: 2-app consolidated deployment (backend + gateway)
110 أسطر
4.6 KiB
Markdown
110 أسطر
4.6 KiB
Markdown
# SOC Command Center on Cumin
|
|
|
|
A full **Security Operations Center (SOC)** platform deployed on [Cumin](https://cumin.dev) — a cloud platform for deploying containerized applications via MCP (Model Context Protocol).
|
|
|
|
## Architecture
|
|
|
|
```
|
|
┌─────────────────────────────────────────────────┐
|
|
│ Internet │
|
|
│ │ │
|
|
│ ┌──────────▼──────────┐ │
|
|
│ │ soc-gateway │ │
|
|
│ │ (Dashboard UI) │ │
|
|
│ │ Port 3000 │ │
|
|
│ └──────────┬──────────┘ │
|
|
│ │ /proxy/* │
|
|
│ ┌──────────▼──────────┐ │
|
|
│ │ soc-backend │ │
|
|
│ │ (All 9 Services) │ │
|
|
│ │ Port 4000 │ │
|
|
│ │ │ │
|
|
│ │ ┌─── SIEM ───┐ │ │
|
|
│ │ ├─── SOAR ───┤ │ │
|
|
│ │ ├── Honeypot ─┤ │ │
|
|
│ │ ├── IDS/IPS ──┤ │ │
|
|
│ │ ├── Firewall ─┤ │ │
|
|
│ │ ├──── UBA ────┤ │ │
|
|
│ │ ├─ Threat Intel┤ │ │
|
|
│ │ ├─ Vuln Scan ──┤ │ │
|
|
│ │ └── Incidents ─┘ │ │
|
|
│ └─────────────────────┘ │
|
|
│ Cumin Cloud │
|
|
└─────────────────────────────────────────────────┘
|
|
```
|
|
|
|
## Services
|
|
|
|
| Service | Role | Description |
|
|
|---------|------|-------------|
|
|
| **SIEM** | Log Collection | Collects and correlates security events from multiple sources |
|
|
| **SOAR** | Orchestration | Automates security responses via playbooks |
|
|
| **Honeypot** | Deception | Deploys traps to detect and track attackers |
|
|
| **IDS/IPS** | Detection | Identifies and blocks intrusion attempts |
|
|
| **Firewall** | Traffic Control | Manages network traffic rules and blocks threats |
|
|
| **UBA** | Behavior Analytics | Detects anomalous user behavior patterns |
|
|
| **Threat Intel** | IOC Feeds | Aggregates threat intelligence from multiple sources |
|
|
| **Vuln Scanner** | Assessment | **Real-time** scanning of actual websites for security headers |
|
|
| **Incidents** | Management | Tracks and manages security incidents end-to-end |
|
|
|
|
## Real Target Monitoring
|
|
|
|
The Vulnerability Scanner performs **actual HTTP security header checks** against real websites:
|
|
- Google, GitHub, Cloudflare (external targets)
|
|
- Self-monitoring of the SOC backend
|
|
|
|
It checks for: `Content-Security-Policy`, `X-Frame-Options`, `X-Content-Type-Options`, `Strict-Transport-Security`, `X-XSS-Protection`, `Referrer-Policy`, `Permissions-Policy`
|
|
|
|
## Project Structure
|
|
|
|
```
|
|
cumin/
|
|
├── src/
|
|
│ ├── backend.js # Combined backend (9 services + real scanning)
|
|
│ └── gateway.js # Dashboard UI server
|
|
├── scripts/
|
|
│ ├── deploy.js # Deploy both apps to Cumin
|
|
│ └── cleanup.js # Delete all apps from project
|
|
├── .gitignore
|
|
└── README.md
|
|
```
|
|
|
|
## Deployment
|
|
|
|
### Prerequisites
|
|
- Node.js 18+
|
|
- A Cumin account with API token
|
|
|
|
### Deploy
|
|
```bash
|
|
node scripts/deploy.js
|
|
```
|
|
|
|
### Cleanup
|
|
```bash
|
|
node scripts/cleanup.js
|
|
```
|
|
|
|
## Tech Stack
|
|
|
|
- **Runtime**: Node.js 22 (Alpine)
|
|
- **Platform**: Cumin Cloud (cumin.dev)
|
|
- **Protocol**: MCP (Model Context Protocol)
|
|
- **Frontend**: Vanilla HTML/CSS/JS with Inter font
|
|
- **Design**: Dark theme, glassmorphism cards
|
|
|
|
## Configuration
|
|
|
|
| Variable | Value | Description |
|
|
|----------|-------|-------------|
|
|
| `PROJECT_ID` | `178bfad9-...` | Cumin project identifier |
|
|
| `CUMIN_TOKEN` | `cumin_...` | API authentication token |
|
|
| Backend CPU | 250m | Backend resource allocation |
|
|
| Backend RAM | 512MB | Backend memory limit |
|
|
| Gateway CPU | 150m | Gateway resource allocation |
|
|
| Gateway RAM | 250MB | Gateway memory limit |
|
|
|
|
## License
|
|
|
|
MIT
|