SOC-ELK-Sigma is a professional SOC pipeline built using the ELK Stack (Elasticsearch, Logstash, Kibana) and Sigma rules for threat detection.
It ingests Linux authentication logs, detects attacks like SSH brute force, triggers alerts, and visualizes events in Kibana dashboards.

This project demonstrates real SOC skills, including log ingestion, detection engineering, alerting, and dashboard creation perfect for a junior SOC analyst or detection engineer portfolio.

• Collects and parses Linux logs via Logstash
• Stores logs in Elasticsearch for fast search
• Detects threats using Sigma rules (SSH brute-force example included)
• Automated alerting in Kibana
• Visual dashboards for real-time SOC monitoring
• Fully containerized with Docker for easy deployment

[Linux Host Logs] --> [Logstash] --> [Elasticsearch] --> [Kibana Dashboard]
                                \
                                 --> [Sigma Rules Detection]

• Docker & Docker Compose installed
• Linux host with authentication logs (/var/log/auth.log)

git clone https://github.com/RUTHRAN-SEC/SOC-ELK-Sigma.git

cd SOC-ELK-Sigma

sudo docker-compose down && sudo docker-compose up -d

http://localhost:5601

• Logs are automatically ingested via Logstash
• Sigma detection rules are in sigma_rules/
• Logstash configuration is in logstash_pipeline/logstash.conf
• Kibana dashboards visualize attacks in real time
• Alerts are automatically generated for matching detection rules
• Example Detection (Sigma Rule)

title: SSH Brute Force Detection
description: Detects multiple failed SSH login attempts
logsource:
  product: linux
  service: sshd
detection:
  selection:
    log_message: "Failed password"
  condition: selection
level: high

- Converts to Elasticsearch query via Sigmac
- Triggers alerts in Kibana if threshold exceeded

• Open an issue or pull request for improvements
• Add more Sigma rules for additional detections
• Extend dashboards with new visualizations