The question
How can I make raw log activity easier to review, prioritize, and explain? This project brings together web development and my interest in defensive security.
Project focus
- Log ingestion and an interface for reviewing events.
- Rule-based detection of suspicious activity.
- Severity filtering and visual summaries to support triage.
What I’m learning
An alert is the beginning of an investigation. Useful context, readable presentation, and a clear next question matter as much as surfacing a match.
The interactive preview on this portfolio is an illustrative concept using six synthetic events. It is not a live SIEM feed or a screenshot of the repository.
Explore the repository (opens in a new tab)