♜ SIEM SANDBOX

PROJECT SNAPSHOT

PROJECT OVERVIEW

The SIEM Sandbox will become the security event review layer of The Citadel. Its purpose is to collect, organize, and visualize security-relevant activity from Linux logs, SSH events, Fail2Ban activity, and future monitoring sources.

This page currently documents the planned direction for transforming raw authentication and system logs into searchable security intelligence.

PLANNED DATA SOURCES

• SSH authentication events from auth.log and journald.
• Fail2Ban jail activity and banned IP counts.
• Apache access and error logs.
• System health telemetry from Argus.
• Suspicious activity events from Sentinel.

FUTURE ARCHITECTURE

NEXT OBJECTIVES

• Collect authentication events into a structured log format.
• Surface failed and successful SSH login counts.
• Integrate Fail2Ban telemetry into the dashboard.
• Create searchable event views for authentication activity.
• Build Sentinel detection rules for suspicious behavior.