Back to Projects

Windows SIEM

End-to-end SIEM pipeline that collects Windows telemetry, detects suspicious activity using custom rules, and sends real-time alerts to Telegram and automation workflows.

Architecture Overview

Windows host runs Sysmon and Winlogbeat to ship logs into a Dockerized Elastic Stack. ElastAlert2 performs rule-based detections and sends alerts to Telegram and n8n workflows.

Key Challenges

Integrating Windows telemetry with containerized ELK stack and handling Telegram API formatting and environment-variable secret management.

Security Considerations

Used environment variables for tokens, separated detection logic from secrets, and implemented automated setup scripts for reproducibility.

Future Improvements

Planned additions include threat-intelligence enrichment, Grafana dashboards, multi-host monitoring, and TLS-enabled secure deployment.

Technical Impact

  • Built a complete SOC pipeline using Sysmon, Winlogbeat, Elasticsearch, Kibana, and ElastAlert2.
  • Developed detection rules for PowerShell abuse, persistence, process injection, service creation, and suspicious network activity.
  • Automated deployment using Docker, batch scripts, and environment-based secret management.