PhilSIEM 🛡️ A Home-Built Security Information & Event Management System Built by Philip O'Malley as part of…
PhilSIEM 🛡️
A Home-Built Security Information & Event Management System
Built by Philip O'Malley as part of a cybersecurity career transition from Jarrow, North East England.
What It Does
* Collects and parses security logs from multiple sources
* Detects brute force attacks, SYN floods, port scans and auth failures
* Stores events in SQLite database
* Visualises threats in real-time Kibana dashboard
* Sends instant Telegram alerts to phone when threats detected
Tech Stack
* Python 3 — core detection engine
* Elasticsearch + Kibana — ELK Stack SIEM
* Docker — containerised deployment
* SQLite — event storage
* Telegram Bot API — mobile alerting
* Filebeat — log ingestion
Features
* Real-time threat detection
* Live Kibana dashboard with severity breakdowns
* Instant mobile alerts via Telegram
* 680+ security events logged
* Brute force, SYN flood, port scan detection
Architecture
* Logs → PhilSIEM Collector → SQLite → Detection Engine ↓ Elasticsearch → Kibana ↓ Telegram Alerts ↓ iPhone 📱
Detection Rules
Rule Trigger Severity
BRUTE_FORCE 3+ failed passwords in 10 mins CRITICAL
SYN_FLOOD SYN flood detected CRITICAL
PORT_SCAN Port scan activity HIGH
AUTH_FAILURE Authentication failure HIGH
SUDO_FAILURE Sudo failure detected HIGH
Incident Response Reports 🛡️
Real-world security incident investigations conducted
as part of home SOC lab operations.
Reports
| ID | Title | Severity | Status |
|----|-------|----------|--------|
| IR-2026-001 | Brute Force SSH Attack via Tor Exit Node | CRITICAL | RESOLVED |
Methodology
Each report follows professional SOC analyst workflow:
1. Detection via PhilSIEM automated alerting
2. Investigation using Kibana dashboard
3. Threat intelligence via AbuseIPDB and Shodan
4. MITRE ATT&CK framework mapping
5. Documented response and recommendations
Tools Used
- PhilSIEM — custom Python SIEM
- Kibana — event visualisation
- AbuseIPDB — threat intelligence
- Shodan — network intelligence
- MITRE ATT&CK — framework mapping
Author
Philip O'Malley | Breaking Into Cyber 🛡️ philsiem.com | LinkedIn: Philip O. CompTIA Security+ | CREST CPSA
Breaking Into Cyber — so the hackers can't.
5 reactions · 0 comments