SOC Detection Lab
Edge-to-cloud SSH honeypot. A Cowrie sensor on a Raspberry Pi 5 captured real attacks over a 14-day run, and its logs flowed through a serverless AWS pipeline into a live React dashboard.
- 36,440 attack sessions from 1,322 IPs in 83 countries, correlated and GeoIP-enriched.
- Deployed 8 Sigma detection rules in Kibana, mapped to MITRE ATT&CK credential access, persistence and command-and-control.
- Pipeline built in Terraform: S3 → Python Lambdas → DynamoDB → API Gateway → CloudFront.
- Every merge gated on 262 tests, secret scanning and Sigma validation, deployed by GitHub Actions over OIDC.
SOC Detection Lab · architecture
As deployed for the May 6–21, 2026 run: a Raspberry Pi 5 running Cowrie as a k3s pod, reached through HAProxy on a DigitalOcean droplet over an autossh reverse tunnel (both edge hosts since decommissioned). fluent-bit ships logs to S3, then Lambda ingest (timestamp-window correlation and MaxMind GeoLite2) → DynamoDB → aggregator → API Gateway HTTP API → React dashboard on CloudFront behind Cloudflare.

