How rachidafaf/cyb691-it691-capstoneprojectfall2026 works
This repository is an OT cybersecurity monitoring testbed and analysis pipeline. Operators can generate baseline Modbus polling and unauthorized writes against a PLC emulator; the resulting Suricata/firewall telemetry is normalized, then consumed by incident triage and ML evaluation. Triage produces both structured and Markdown reports, while ML produces benchmark results. The README also describes microsegmentation and security hardening, but the tree and sampled runtime code do not show an implementation of those controls. Some parser wiring is based on README documentation because its full source was not sampled.
Main entry points: normalized_telemetry.json Normalized Telemetry · timeline_generator.py Incident Triage · log_parser.py Telemetry Parser · traffic_generator.py Modbus Traffic Generator
Components 14
OT Testbed
- Modbus Traffic Generator
infrastructure/traffic_generator.py - PLC Emulator
- Suricata / pfSense
- Suricata EVE Logs
infrastructure/extracted_handoff/var/log/suricata/eve.json - Sample Alert
infrastructure/logs/sample_suricata_alert.json
Telemetry Normalization
- Telemetry Handoff
infrastructure/ot_telemetry_handoff_2026-09-26.tar.gz - Telemetry Parser
src/log_parser.py - Normalized Telemetry
data/normalized_telemetry.json
Detection & Triage
- Incident Triage
src/timeline_generator.py - ML Detection
src/ml_detector.py
Analysis Artifacts
- Incident Metrics
data/incident_report.json - Incident Timeline
data/incident_timeline.md - ML Benchmarks
data/ml_evaluation_results.json
Other components
- Operator
Connections 13
- Operator → Modbus Traffic Generator: runs
- Modbus Traffic Generator → PLC Emulator: sends Modbus
- PLC Emulator → Suricata / pfSense: generates traffic
- Suricata / pfSense → Suricata EVE Logs: records events
- Suricata / pfSense → Sample Alert: emits alerts
- Suricata EVE Logs → Telemetry Parser: ingests logs
- Telemetry Handoff → Telemetry Parser: extracts archive
- Telemetry Parser → Normalized Telemetry: writes records
- Normalized Telemetry → Incident Triage: reads telemetry
- Normalized Telemetry → ML Detection: reads telemetry
- Incident Triage → Incident Metrics: writes metrics
- Incident Triage → Incident Timeline: writes timeline
- ML Detection → ML Benchmarks: writes benchmarks