Back to Projects
Windows SIEM
End-to-end SIEM pipeline that collects Windows telemetry, detects suspicious activity using custom rules, and sends real-time alerts to Telegram and automation workflows.
Architecture Overview
Windows host runs Sysmon and Winlogbeat to ship logs into a Dockerized Elastic Stack. ElastAlert2 performs rule-based detections and sends alerts to Telegram and n8n workflows.
Key Challenges
Integrating Windows telemetry with containerized ELK stack and handling Telegram API formatting and environment-variable secret management.
Security Considerations
Used environment variables for tokens, separated detection logic from secrets, and implemented automated setup scripts for reproducibility.
Future Improvements
Planned additions include threat-intelligence enrichment, Grafana dashboards, multi-host monitoring, and TLS-enabled secure deployment.
Technical Impact
- Built a complete SOC pipeline using Sysmon, Winlogbeat, Elasticsearch, Kibana, and ElastAlert2.
- Developed detection rules for PowerShell abuse, persistence, process injection, service creation, and suspicious network activity.
- Automated deployment using Docker, batch scripts, and environment-based secret management.