ThreatLens

Threat Intelligence–Driven Detection & Alerting Engine

ThreatLens is a mini-SIEM / detection engineering project that simulates how modern Security Operations Centers (SOCs) ingest threat intelligence, correlate security events, apply MITRE ATT&CK mapping, score risk, escalate alerts, and export SOC-ready outputs.

This project was built to demonstrate real-world detection engineering, SOC workflows, and DFIR concepts — not just log parsing.

---

🚀 Key Features

🔹 Threat Intelligence Ingestion

• Loads external IOC feeds (IP-based indicators)
• Matches indicators against security events

🔹 Detection & Correlation Engine

• Correlates events by source IP
• Detects malicious behavior (e.g., brute-force attempts)
• Counts repeated occurrences

🔹 MITRE ATT&CK Mapping

• Automatically maps detections to:

  • Tactic
  • Technique
  • Technique ID (e.g., T1110 – Brute Force)

🔹 Risk Scoring Engine

• Calculates risk based on:

  • Threat intel confidence
  • Frequency of events

• Assigns severity levels: LOW / MEDIUM / HIGH

🔹 SOC Alert Lifecycle

• Generates unique Alert IDs

• Tracks alert status:

  • NEW
  • ESCALATED

• Records first_seen and last_seen timestamps

🔹 Escalation Logic

• Automatically escalates alerts when risk increases
• Simulates Tier-1 → Tier-2 SOC workflows

🔹 SOC-Ready JSON Export

• Exports alerts to timestamped JSON files
• Ready for SIEM ingestion or case management systems

---

🗂️ Project Structure

ThreatLens/
│
├── intel/
│   └── threat_intel.json        # Threat intelligence feed (IOCs)
│
├── logs/
│   └── Sample_auth.log          # Sample authentication logs
│
├── mitre/
│   └── mitre_mapping.py         # MITRE ATT&CK tactic & technique mappings
│
├── alert-manager.py             # SOC alert lifecycle management
├── detector.py                  # Event detection logic
├── matcher.py                   # IOC matching engine
├── escalation_engine.py         # Alert escalation rules
├── risk_engine.py               # Risk scoring logic
├── exporter.py                  # SOC-style alert export
├── rules.py                     # Detection thresholds & rules
├── events.json                  # Parsed security events
├── requirements.txt             # Dependencies (standard library only)
└── README.md

ThreatLens/
│
├── intel/
│   └── threat_intel.json        # Threat intelligence feed (IOCs)
│
├── events.json                  # Security events
├── rules.py                     # MITRE ATT&CK mappings
├── risk_engine.py               # Risk scoring logic
├── alert_manager.py             # Alert lifecycle management
├── escalation_engine.py         # Alert escalation rules
├── exporter.py                  # SOC-style alert export
├── matcher.py                   # Core detection engine
└── README.md

---

▶️ How It Works (High Level)

1. Load threat intelligence (IOC feeds)
2. Load security events
3. Match events against IOCs
4. Map detections to MITRE ATT&CK
5. Calculate risk score & severity
6. Create SOC-style alerts
7. Escalate alerts when required
8. Export alerts to JSON for SOC handoff

---

▶️ How to Run

1️⃣ Install requirements

This project uses Python standard library only.

No external dependencies are required.

python --version
```bash
pip install -r requirements.txt

2️⃣ Run the detection engine

python matcher.py

3️⃣ Output

• Alerts printed to the terminal

• Exported alert file created:

  alerts_YYYYMMDD_HHMMSS.json
  

---

📌 Example Alert Output

{
  "alert_id": "ALERT-9F3A1C2B",
  "status": "ESCALATED",
  "first_seen": "2025-01-01 12:01:00",
  "last_seen": "2025-01-01 12:01:00",
  "details": {
    "source_ip": "185.220.101.1",
    "attack_type": "Brute Force",
    "risk_score": 12,
    "severity": "HIGH",
    "mitre": {
      "tactic": "Credential Access",
      "technique": "Brute Force",
      "technique_id": "T1110"
    }
  }
}

---

🎯 Skills Demonstrated

• Detection Engineering
• Threat Intelligence Analysis
• MITRE ATT&CK Framework
• SOC Alert Lifecycle Management
• Risk Scoring & Escalation
• Python backend engineering
• DFIR fundamentals

---

📈 Future Enhancements

• Multiple threat intel feeds
• Alert suppression & tuning
• Case management simulation
• CLI interface
• Time-based correlation windows

---

👤 Author

Victor Egwu Cybersecurity Analyst | Detection Engineering | SOC

---

⚠️ This project is for educational and portfolio purposes only.