SentinelOPS Real‑Time SIEM

An open‑source, real‑time security monitoring platform that ingests Wazuh alerts, stores them in AWS DynamoDB, and visualises the data instantly on a Vercel‑hosted dashboard.

Comment

SentinelOPS: Cloud-Native SIEM & Security Operations Center

💡 Inspiration

Modern Security Information and Event Management (SIEM) platforms are typically heavy, complex, and expensive to host. Security Operations Centers (SOC) need lightweight, fast, and highly reliable tools to visualize threat landscapes.

We were inspired to build a cloud-native, serverless security dashboard that seamlessly connects telemetry logs (like Wazuh security alerts) with a serverless cloud database (AWS DynamoDB), making real-time log analysis and threat intelligence accessible to teams of any size.

🛠️ How We Built It

SentinelOPS is structured into three integrated components:

  1. Telemetry & Rule Engine: Security logs are evaluated (e.g. from Wazuh or Kali attack simulations) and trigger normalized JSON security alerts.
  2. Serverless API Backend: A Python Flask service hosted on Vercel Serverless Functions parses, tags (using MITRE ATT&CK alignment), and routes alerts. It interfaces directly with AWS DynamoDB using the boto3 SDK to write and read persistent threat records.
  3. Cyber-Operations Frontend: An interactive, glassmorphic React dashboard deployed on Vercel that polls the backend, providing real-time log grids, hourly trend charts, threat statistics, and attacker IP frequency rankings.

Mathematical analysis of hourly event distribution uses standard buckets: $$H_i = \sum_{a \in A} \mathbb{I}(\text{hour}(a.\text{timestamp}) = i)$$ Where $A$ is the set of alerts in the last 24 hours, and $\mathbb{I}$ is the indicator function.

🚧 Challenges We Faced

  • Serverless Cold Starts & Cloud Database Connections: Instantiating connection pools to AWS DynamoDB on every invocation of serverless functions can introduce latency. We optimized our boto3 client initialization to run outside the main routing handler, utilizing runtime caching to keep response times under $50\text{ ms}$.
  • Hybrid High-Availability Fallback: Security telemetry cannot afford downtime. We engineered robust fallback mechanics: if the DynamoDB table is unreachable or credentials are unprovisioned, the backend gracefully switches to local file streams and mock buffers so the dashboard interface remains operational.

📚 What We Learned

  • How to design efficient DynamoDB schemas for time-series security logs using partition keys (id) and sort keys (timestamp).
  • Structuring monorepos for single-command Vercel serverless deployment containing both a Flask Python engine and a static React frontend.
  • Aligning signature-based alert structures with the MITRE ATT&CK framework for automated threat classification.

Built With

Share this project:

Updates