SIEM & SOC 3D Architecture
Simulasi interaktif pipeline SIEM end-to-end: pemantauan log server, pelacakan IP penyerang & aktivitas MITRE ATT&CK, parser normalisasi, aturan korelasi Sigma, hingga playbook aksi otomatis SOAR.
Log Collector5.3k EPS
Parsing0 parsed
SIEM Core0 alerts
Dashboard0 in queue
Response0 blocked
web-prod-01 10.0.1.12
nginx · modsec · 1.4k EPS
bastion-01 10.0.0.10
sshd · auditd · 320 EPS
dc-01 10.0.0.5
Security.evtx · Sysmon · 980 EPS
db-prod-01 10.0.2.8
mysql audit · 410 EPS
fw-edge-01 10.0.0.1
filterlog · suricata · 2.1k EPS
scanning…
no actor
scanning…
no actor
scanning…
no actor
scanning…
no actor
Normalize
Logstash grok + dissect · 0 parsed
GeoIP
MaxMind GeoLite2 · 0 enriched
Threat Intel
AbuseIPDB · OTX · MISP · 0 IOC hits
Brute Force
T1110 · 0 hits
Web Attack
T1190 · 0 hits
Recon / Scan
T1046 · 0 hits
C2 Beacon
T1071.001 · 0 hits
Live Alerts
queue empty
Top Attackers
—
MITRE Heatmap
0 techniques seen
FW Auto-Block
0 IPs dropped
EDR Isolate
0 hosts isolated
Case & Notify
0 cases · Slack
Internet · Untrusted
Internal · Log Sources
SIEM ARCHITECTURE // LIVE SIMULATION
EPS
5.3k
ALERTS
0
BLOCKED
0
THREATS
0
Attacker / maliciousLog source / benignDetection ruleSOAR action