# bmalin77/master-of-the-soc---splunk architecture

> Architecture diagram of the GitHub repository bmalin77/master-of-the-soc---splunk, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-11-13). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/bmalin77/master-of-the-soc---splunk
- Repository: https://github.com/bmalin77/master-of-the-soc---splunk

## Overview

This repository is a Splunk SOC-analysis exercise for monitoring VSI’s Windows server and Apache website. The documented workflow is to load the supplied logs into Splunk, analyze their fields, and build reports, threshold alerts, and time-filterable dashboards; alerts email the SOC. The README describes the intended artifacts, but no implementation or saved Splunk configuration is present, so artifact nodes have no source path. Relationships below reflect documentation, not inspected runtime code.

Main entry points: [`Resources/2-Homework_19-SIEMs-2_resources_windows_server_logs.csv`](https://github.com/bmalin77/master-of-the-soc---splunk/blob/main/Resources/2-Homework_19-SIEMs-2_resources_windows_server_logs.csv) (Windows server logs), [`Resources/2-Homework_19-SIEMs-2_resources_windows_server_attack_logs.csv`](https://github.com/bmalin77/master-of-the-soc---splunk/blob/main/Resources/2-Homework_19-SIEMs-2_resources_windows_server_attack_logs.csv) (Windows attack logs), [`Resources/2-Homework_19-SIEMs-2_resources_apache_logs.txt`](https://github.com/bmalin77/master-of-the-soc---splunk/blob/main/Resources/2-Homework_19-SIEMs-2_resources_apache_logs.txt) (Apache server logs), [`Resources/2-Homework_19-SIEMs-2_resources_apache_attack_logs.txt`](https://github.com/bmalin77/master-of-the-soc---splunk/blob/main/Resources/2-Homework_19-SIEMs-2_resources_apache_attack_logs.txt) (Apache attack logs)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_data["Log datasets"]
  node_windows_logs["Windows server logs"]
  node_windows_attack["Windows attack logs"]
  node_apache_logs["Apache server logs"]
  node_apache_attack["Apache attack logs"]
end

subgraph group_windows["Windows monitoring"]
  node_win_reports["Signature, severity, status reports"]
  node_win_fail_alert["Failed activity alert"]
  node_win_login_alert["Successful login alert"]
  node_win_delete_alert["Account deletion alert"]
  node_win_dashboard["Windows monitoring dashboard"]
end

subgraph group_apache["Apache monitoring"]
  node_apache_reports["Methods, referrers, response reports"]
  node_apache_country_alert["Non-US activity alert"]
  node_apache_post_alert["POST activity alert"]
  node_apache_dashboard["Apache monitoring dashboard"]
end

subgraph group_platform["Splunk workspace"]
  node_splunk["Splunk environment"]
end

node_analyst(("SOC analyst"))
node_soc_email(("SOC email recipient"))

node_analyst -->|"loads and analyzes"| node_splunk
node_windows_logs -->|"loads into"| node_splunk
node_windows_attack -->|"loads into"| node_splunk
node_apache_logs -->|"loads into"| node_splunk
node_apache_attack -->|"loads into"| node_splunk
node_splunk -->|"builds"| node_win_reports
node_splunk -->|"configures"| node_win_fail_alert
node_splunk -->|"configures"| node_win_login_alert
node_splunk -->|"configures"| node_win_delete_alert
node_splunk -->|"builds"| node_win_dashboard
node_splunk -->|"builds"| node_apache_reports
node_splunk -->|"configures"| node_apache_country_alert
node_splunk -->|"configures"| node_apache_post_alert
node_splunk -->|"builds"| node_apache_dashboard
node_win_fail_alert -->|"emails alert"| node_soc_email
node_win_login_alert -->|"emails alert"| node_soc_email
node_win_delete_alert -->|"emails alert"| node_soc_email
node_apache_country_alert -->|"emails alert"| node_soc_email
node_apache_post_alert -->|"emails alert"| node_soc_email

click node_windows_logs "https://github.com/bmalin77/master-of-the-soc---splunk/blob/main/Resources/2-Homework_19-SIEMs-2_resources_windows_server_logs.csv"
click node_windows_attack "https://github.com/bmalin77/master-of-the-soc---splunk/blob/main/Resources/2-Homework_19-SIEMs-2_resources_windows_server_attack_logs.csv"
click node_apache_logs "https://github.com/bmalin77/master-of-the-soc---splunk/blob/main/Resources/2-Homework_19-SIEMs-2_resources_apache_logs.txt"
click node_apache_attack "https://github.com/bmalin77/master-of-the-soc---splunk/blob/main/Resources/2-Homework_19-SIEMs-2_resources_apache_attack_logs.txt"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_windows_logs,node_windows_attack,node_apache_logs,node_apache_attack toneBlue
class node_win_reports,node_win_fail_alert,node_win_login_alert,node_win_delete_alert,node_win_dashboard toneAmber
class node_apache_reports,node_apache_country_alert,node_apache_post_alert,node_apache_dashboard toneMint
class node_splunk toneRose
class node_analyst,node_soc_email toneIndigo
```

## Components

### Log datasets

- [Windows server logs](https://github.com/bmalin77/master-of-the-soc---splunk/blob/main/Resources/2-Homework_19-SIEMs-2_resources_windows_server_logs.csv): `Resources/2-Homework_19-SIEMs-2_resources_windows_server_logs.csv`
- [Windows attack logs](https://github.com/bmalin77/master-of-the-soc---splunk/blob/main/Resources/2-Homework_19-SIEMs-2_resources_windows_server_attack_logs.csv): `Resources/2-Homework_19-SIEMs-2_resources_windows_server_attack_logs.csv`
- [Apache server logs](https://github.com/bmalin77/master-of-the-soc---splunk/blob/main/Resources/2-Homework_19-SIEMs-2_resources_apache_logs.txt): `Resources/2-Homework_19-SIEMs-2_resources_apache_logs.txt`
- [Apache attack logs](https://github.com/bmalin77/master-of-the-soc---splunk/blob/main/Resources/2-Homework_19-SIEMs-2_resources_apache_attack_logs.txt): `Resources/2-Homework_19-SIEMs-2_resources_apache_attack_logs.txt`

### Windows monitoring

- **Signature, severity, status reports**
- **Failed activity alert**
- **Successful login alert**
- **Account deletion alert**
- **Windows monitoring dashboard**

### Apache monitoring

- **Methods, referrers, response reports**
- **Non-US activity alert**
- **POST activity alert**
- **Apache monitoring dashboard**

### Splunk workspace

- **Splunk environment**

### Other components

- **SOC analyst**
- **SOC email recipient**

## Connections

- SOC analyst → Splunk environment: loads and analyzes (evidence: `README.md`)
- Windows server logs → Splunk environment: loads into (evidence: `README.md`)
- Windows attack logs → Splunk environment: loads into (evidence: `README.md`)
- Apache server logs → Splunk environment: loads into (evidence: `README.md`)
- Apache attack logs → Splunk environment: loads into (evidence: `README.md`)
- Splunk environment → Signature, severity, status reports: builds (evidence: `README.md`)
- Splunk environment → Failed activity alert: configures (evidence: `README.md`)
- Splunk environment → Successful login alert: configures (evidence: `README.md`)
- Splunk environment → Account deletion alert: configures (evidence: `README.md`)
- Splunk environment → Windows monitoring dashboard: builds (evidence: `README.md`)
- Splunk environment → Methods, referrers, response reports: builds (evidence: `README.md`)
- Splunk environment → Non-US activity alert: configures (evidence: `README.md`)
- Splunk environment → POST activity alert: configures (evidence: `README.md`)
- Splunk environment → Apache monitoring dashboard: builds (evidence: `README.md`)
- Failed activity alert → SOC email recipient: emails alert (evidence: `README.md`)
- Successful login alert → SOC email recipient: emails alert (evidence: `README.md`)
- Account deletion alert → SOC email recipient: emails alert (evidence: `README.md`)
- Non-US activity alert → SOC email recipient: emails alert (evidence: `README.md`)
- POST activity alert → SOC email recipient: emails alert (evidence: `README.md`)