SIEMVisual

Inspiration

After having done many home lab projects that utilized Splunk, I came to the realization that in enterprise security, logs can become very overwhelming when coming from various different resources. This can include end user devices, firewalls/routers, virtual machines, or servers. At a certain point, it becomes nearly impossible for a human to parse through all these logs and map out a timeline of events, especially in severe situations like attacks. This is why we build SIEMVisual

What it does

SIEMVisual is a security information and event management tool that goes the extra step by visualizing a timeline of important events based on log files. This can be either from CSV files, txt files, JSON files, or directly from the Syslog protocol. SIEMVisual filters out all the logs that don't produce any meaningful information and produce a visual timeline from it. There are levels of abstraction to the generated timelines so that they can either be used by a layman like a manager, a entry level SOC analyst, or someone who occupies a senior cybersecurity role at a company. This solves the problem of explaining technical concepts to non technical people, a challenge often faced in this line of work. The timeline can either be viewed interactively or through a video that utilizes text-to-speech to better explain the ideas.

How we built it

We built SIEMVisual in TypeScript, with a Node.js and Express backend and a React frontend. The logs get parsed and put on one timeline, then run through detection rules mapped to MITRE ATT&CK, and optionally through Claude to fill in the gaps and write the explanations. The videos are made with Remotion and narrated with Piper, an open source text-to-speech engine that runs locally. We use Claude Code to assist development and putting all the features together.

Challenges we ran into

One of the biggest challenges was getting logs from different sources to line up, since every device formats its timestamps differently and some don't even include the year. We also had to make sure the AI wasn't making things up, so every event it reports has to point back to the actual log lines that prove it. Pulling logs from things like OpenWrt and Proxmox was harder than expected too, since the logs aren't always where you'd think they are.

Accomplishments that we're proud of

We're proud that we were all able to step out our typical lines of work and learn a lot about a topic such as cybersecurity. We are computer science majors but are not very experienced in this line of work, so expanding our knowledge about operating systems and defense security tools was a great experience. We are also proud that we were able to make a software that can be used for non-technical and technical people. We were also proud that we were able have our software integrate with some real tools such as Proxmox and OpenWrt along with different operating system events.

What we learned

We learned that collecting logs is the easy part, and actually making sense of them fast enough to do something about it is the hard part. We also learned a lot about how attacks actually show up in logs. More specifically, we learned how to present the full picture of an attack, information from multiple different devices needs to be pieced together to really understand what happened during a certain timeframe.

What's next for SIEMVisual

We would want SIEMVisual to integrate more with other tools in the future. For example, on the cloud side of things, something like a AWS CloudWatch intergation would help companies that store certain logs in the cloud. More integration with standard routers like Ubiquiti and TPlink would prove to be useful. And most importantly, an integration/plugin for other SIEM's like splunk to visualize an already done for you system. Additionally, another very important aspect would an integration with tools such as gmail and outlook since many attacks are conducted through phishing scams.