A working Linux SIEM built on a laptop. Ingests host telemetry (process execution, identity file changes, file integrity) into Elasticsearch, queryable in real time through Kibana. Built to practice detection engineering — the discipline of writing rules that catch attacker behavior in log data.
Above: Kibana Discover showing a whoami → sudo whoami → ls /etc/shadow → sudo cat /etc/shadow sequence captured by Auditbeat in real time. A common post-compromise pattern where an attacker enumerates their privileges and dumps password hashes for offline cracking.
- Collects Linux syscall audit events, identity file writes, and file integrity events from the host.
- Streams them into Elasticsearch via Auditbeat.
- Provides real-time querying and dashboards through Kibana.
- Ships with a starter set of audit rules aligned to common attacker techniques.
See docs/architecture.md.
| Component | Version | Role |
|---|---|---|
| Elasticsearch | 8.15.3 | Log datastore |
| Kibana | 8.15.3 | Query UI + dashboards |
| Auditbeat | 8.15.3 | Host log shipper |
| Linux auditd | kernel | Syscall + file audit |
| Docker Engine | 29.6.2 | Runs Elastic + Kibana |
| Host OS | Linux Mint 22.3 (Ubuntu 24.04 base) | Endpoint |
git clone https://github.com/Megh089/home-siem-lab.git
cd home-siem-lab
# Bring up Elastic + Kibana
docker compose up -d
# Install Auditbeat on the host (see docs/setup.md for full steps)
sudo cp config/auditbeat.yml /etc/auditbeat/auditbeat.yml
sudo auditbeat setup --dashboards
sudo systemctl enable --now auditbeat
# Verify
curl -s 'http://localhost:9200/_cat/indices/auditbeat-*?v'
# Open http://localhost:5601 in a browser- Week 1: Elastic + Kibana + Auditbeat running, host telemetry visible in Kibana
- Week 2: 4 Sigma detection rules written, 3 fully validated (credential access, shell execution, user creation), 1 written but blocked on file_integrity limitation (documented)
- Week 3: Custom Kibana dashboard for alert volume, top processes, network anomalies
- Week 4: False-positive measurement over 2 weeks of real endpoint activity, write-up
This is a lab, not a production deployment. Called out honestly:
- Single endpoint. A real SIEM aggregates thousands of hosts. Detection tuning at N=1 doesn't reveal fleet-wide false positive patterns.
- Security disabled on Elasticsearch.
xpack.security.enabled=falsemeans no auth and no TLS. Bound to127.0.0.1only, but any production deployment would enable security and use certificates. - Single-node cluster → indices are yellow, not green (no replicas possible). Fine for a lab; would violate resiliency requirements in production.
- Synthetic attacks. Detections in Week 2 will be validated against Atomic Red Team simulations, not real intrusions. Real attacker behavior varies.
- Host-based Auditbeat. The shipper runs on the host, not in Docker, because syscall auditing requires kernel access. This limits portability of the setup.
Megh J — computer security student, York University. Part of an ongoing portfolio; see gps-spoof-detection for related work on drone security.