How soobinzinzin/mini-soc-dashboard works
Mini-SOC Lab simulates three site networks, detects attacks with Snort sensors, and includes a shipper-to-central-API telemetry workflow. An operator exercises the lab through the attacker and can inspect sensor alerts; the agent tails and parses Snort fast-alert lines, then forwards telemetry to the API, which validates, buffers, and exposes records and aggregate statistics. The README describes the three-site topology and alerting; source excerpts show the agent and API internals. The README’s future PostgreSQL and dashboard integrations are not implemented here.
Main entry points: main.py Ingestion API · snort.conf Snort sensors · agent.py Shipper agent · attacker Attacker container
Components 12
Attack Lab
- Attacker container
attacker - Site victims
victim
Site Detection
- Snort sensors
sensor/snort.conf - Detection rules
sensor/local.rules - Fast alert log
sensor
Telemetry Shipping
- Shipper agent
agent/agent.py - Alert parser
agent/agent.py
Central API
- Ingestion API
central/main.py - Telemetry schemas
central/schemas.py - Telemetry buffer
central/main.py
Other components
- Lab operator
- API consumers
Connections 12
- Lab operator → Attacker container: runs tests
README.md - Attacker container → Site victims: attacks
README.md - Site victims → Snort sensors: network monitored
README.md - Snort sensors → Detection rules: uses rules
- Snort sensors → Fast alert log: emits alerts
- Shipper agent → Fast alert log: tails
agent/agent.py - Shipper agent → Alert parser: parses lines
agent/agent.py - Alert parser → Ingestion API: posts telemetry
agent/agent.py - Ingestion API → Telemetry schemas: validates payload
central/main.py - Ingestion API → Telemetry buffer: appends records
central/main.py - Ingestion API → Telemetry buffer: reads records
central/main.py - API consumers → Ingestion API: queries telemetry
central/main.py