This project demonstrates a simulated Security Information and Event Management (SIEM) investigation performed in a controlled laboratory environment. The objective was to analyze security logs, correlate events, identify suspicious activity, and document findings through a structured incident investigation process.
The investigation focused on detecting indicators of compromise, analyzing authentication events, and assessing potential security risks associated with unauthorized access attempts.
This project simulates a SOC analyst investigation workflow, including event correlation, timeline construction, threat identification, and incident reporting based on realistic security event data.
A series of suspicious authentication events were identified involving repeated failed login attempts against an administrative account. Following these attempts, a successful login was recorded from the same source IP address. Additional activities including privilege escalation, administrative account creation, and access to sensitive files were observed and investigated.
- Analyze security event logs for suspicious activity.
- Perform event correlation to establish relationships between events.
- Construct an incident timeline.
- Identify potential indicators of compromise (IOCs).
- Assess the security impact of observed activities.
- Develop recommendations to improve security posture.
- Security Event Logs
- SIEM Concepts & Event Correlation
- Incident Investigation Methodology
- Microsoft Word
- GitHub
Log Collection
↓
Authentication Analysis
↓
Event Correlation
↓
Timeline Construction
↓
Incident Investigation
↓
Findings & Recommendations
- Brute-force authentication activity detected.
- Successful login observed following repeated authentication failures.
- Privilege escalation activity identified.
- Unauthorized administrative account creation detected.
- Potential data exfiltration indicators observed.
- Security Event Monitoring
- Log Analysis
- Event Correlation
- Incident Investigation
- Threat Detection
- Brute-Force Attack Analysis
- Privilege Escalation Analysis
- Security Reporting
- Incident Documentation
The complete investigation report is available below:
This project was conducted in a simulated laboratory environment for educational, research, and defensive cybersecurity purposes only. All logs, events, and investigation activities were generated as part of a controlled security monitoring exercise.