Timeline: Apr 2026 – May 2026
This project is a full-stack Security Operations Center (SOC) simulator developed as my university capstone project.
It generates synthetic security events, evaluates them using an AI-assisted confidence scoring engine, maps detections to the MITRE ATT&CK framework, automatically creates incidents, and displays everything through a live React dashboard with JWT authentication, real-time updates, PDF reporting, and optional Elasticsearch-powered log search.
After completing the random attack simulator, I added a reproducible benchmark suite containing fixed attack scenarios with expected outputs. This makes it possible to verify that the detection pipeline behaves consistently across multiple runs rather than relying only on randomly generated events.
⚠️ This project is a simulator for educational and research purposes. All attacks, logs, IP addresses, and incidents are synthetically generated.
Most SOC platforms are only available inside enterprise environments.
I wanted to build one from scratch to better understand how threat detection pipelines work, from simulated attacks and event processing to incident management and dashboard visualization.
The benchmark suite was added to make the project reproducible. Random simulations are useful for demonstrations, while fixed benchmark scenarios make it possible to verify that changes to the detection pipeline continue to produce the expected results.
- 🔐 JWT Authentication
- 🖥️ React Dashboard with live metrics
- ⚡ Real-time updates using Socket.IO
- 🤖 AI-assisted threat confidence scoring
- 🎯 MITRE ATT&CK mapping
- 🚨 Automatic incident generation
- 📄 PDF report export
- 🔍 Elasticsearch log search with automatic SQLite fallback
- 🧪 Reproducible benchmark scenarios
- 📊 Benchmark evaluation framework
User
│
│
React Frontend
(Redux Toolkit • Recharts • Socket.IO)
│
│
REST API + WebSocket Layer
│
Flask Backend
│
┌─────────────┬─────────────┬─────────────┐
│ │ │ │
Authentication SOC Engine Benchmark Reports
(JWT) AI Scoring Engine PDF
MITRE Map
│
SQLite Database
│
Elasticsearch (Optional)
Additional implementation details are available in the project documentation.
| Layer | Technology |
|---|---|
| Backend | Python, Flask, SQLAlchemy, SQLite |
| Frontend | React, Vite, Redux Toolkit |
| Authentication | Flask-JWT-Extended |
| Real-time | Flask-SocketIO |
| AI Scoring | NumPy |
| Charts | Recharts |
| Reports | ReportLab |
| Search | Elasticsearch with SQLite fallback |
| Benchmarking | Fixed attack scenarios + evaluation framework |
soc-dashboard/
├── backend/ Backend API and services
├── frontend/ React dashboard
├── benchmark/ Reproducible benchmark suite
├── docs/ Screenshots and documentation
└── docker-compose.yml
Detailed documentation is available inside each directory.
- 📘
backend/README.md - 📗
frontend/README.md - 📙
benchmark/README.md
- Python 3.10+
- Node.js 18+
- npm
- Docker (optional, for Elasticsearch)
cd backend
python -m venv .venv
# Windows
.venv\Scripts\Activate.ps1
# Linux / macOS
source .venv/bin/activate
pip install -r requirements.txt
python run.pycd frontend
npm install
npm run devOpen:
http://localhost:5173
Default account:
Username: admin
Password: admin123
After logging in you can:
- Simulate different cyber attacks
- Watch threats appear in real time
- View MITRE ATT&CK mappings
- Search security logs
- Investigate incidents
- Export PDF reports
- Load benchmark scenarios
- Run the benchmark evaluation suite
The benchmark suite contains nine reproducible attack scenarios that use fixed log datasets and expected outputs.
Unlike the random simulator, benchmark scenarios always produce the same input, making them useful for regression testing and validation.
Run the evaluation suite:
cd benchmark/evaluation
python evaluate.pyLatest evaluation:
9 / 9 scenarios passed
63 / 63 validation checks passed
See benchmark/README.md for complete documentation.
All protected API routes require a valid JWT.
The frontend automatically stores the token and attaches it to authenticated requests. Sessions expire after eight hours.
See backend/README.md for implementation details.
| Method | Endpoint | Description |
|---|---|---|
| POST | /api/auth/login |
Login |
| POST | /api/auth/register |
Register |
| GET | /api/soc/overview |
Dashboard metrics |
| POST | /api/soc/simulate |
Simulate attack |
| GET | /api/soc/logs |
Security logs |
| GET | /api/soc/threats |
Detected threats |
| GET | /api/soc/incidents |
Incidents |
| GET | /api/assets |
Assets |
| POST | /api/reports/export |
Export PDF |
| GET | /api/benchmark/scenarios |
Benchmark scenarios |
| POST | /api/benchmark/load |
Load benchmark scenario |
Additional endpoints are documented in backend/README.md.
This project was designed as an educational SOC simulator.
Current limitations include:
- No role-based access control
- Development server configuration
- Synthetic security events
- No automated frontend test suite
- Name-based asset references
These are discussed further in the project report.
Before using this project outside a local environment:
- Configure a secure
JWT_SECRET_KEY - Change the default administrator password
- Restrict CORS
- Add registration controls
- 📘
backend/README.md - 📗
frontend/README.md - 📙
benchmark/README.md
Project Type: University Capstone Project
Domain: Cybersecurity • Security Operations • Threat Detection • Full-Stack Development
This project explores how a simulated Security Operations Center can demonstrate detection, incident response, and reproducible evaluation without requiring production infrastructure or live network traffic.
⭐ Feel free to explore the code, run the simulator, and experiment with the benchmark scenarios.