## https://sploitus.com/exploit?id=FB0B0BB2-37E7-5464-9D04-397B422AEA86
# ThreatLens
**A real-time, log-based intrusion detection engine with MITRE ATT&CK correlation and a live web dashboard.**
Ingests SSH and web server logs, detects attack patterns using rule-based
sliding-window logic, maps each detection to a MITRE ATT&CK technique,
and displays it all on a live-updating dashboard.
## What it does
- **Watches log files in real time** (like `tail -f`) — SSH auth logs and
web server access logs.
- **Detects, using rule-based logic:**
- SSH brute-force attempts (sliding time-window failure tracking)
- Successful logins immediately following a brute-force burst (possible
account compromise)
- SQL injection attempts in URL parameters
- Cross-site scripting (XSS) attempts
- Directory traversal attempts
- Known scanner tool signatures in User-Agent strings (sqlmap, nikto,
gobuster, nmap, etc.)
- High-rate endpoint enumeration/scanning
- **Maps every detection to a MITRE ATT&CK technique ID** (e.g. `T1110.001
— Brute Force: Password Guessing`, tactic: *Credential Access*), the way
real SOC playbooks and detection rules do.
- **Live dashboard** (Flask + Chart.js): summary stat cards, an alerts-
over-time chart, a top-attacker-IPs chart, and a live alert table —
auto-refreshing every 3 seconds.
## Architecture
```
detection_engine.py → parsers, regex signatures, sliding-window detectors,
MITRE ATT&CK mapping table, Alert/AlertStore model,
LogWatcher (tails files in a background thread)
app.py → Flask app: wires up watchers, exposes /api/alerts
and /api/stats, serves the dashboard
static/dashboard.html → single-page dashboard (vanilla JS + Chart.js)
data/generate_sample_logs.py → builds realistic baseline + seeded-attack logs
simulate_attack.py → appends live attack traffic for demos
```
This separation (parsing → detection → storage → API → UI) mirrors how
real detection pipelines are structured, which is worth mentioning in an
interview — it shows you're not just scripting checks, you're thinking
about the pipeline.
## Setup
```bash
pip install -r requirements.txt
python data/generate_sample_logs.py # seeds baseline + attack log data
python app.py # starts the dashboard at :5000
```
Open **http://127.0.0.1:5000** — you'll immediately see alerts from the
seeded attack data (a brute-force burst, SQLi/XSS/traversal attempts, and
a scanner sweep).
### Live demo mode (great for interviews)
In a second terminal, while `app.py` is running:
```bash
python simulate_attack.py # fires one random attack scenario
python simulate_attack.py --loop # fires a new scenario every ~15-20s
```
Watch the dashboard update in real time — the stat cards, charts, and
alert table all react within ~3 seconds, with no page refresh.
## Why this is a stronger portfolio piece than a scanner
| | Vulnerability scanner | ThreatLens |
|---|---|---|
| Perspective | Offensive (finds weaknesses) | Defensive (detects attacks in progress) |
| Skills shown | HTTP requests, regex | Log parsing, stateful detection logic, threat framework knowledge, real-time systems, dashboarding |
| What it maps to on the job | One-off assessment | Day-to-day SOC/blue-team work |
| Talking points in an interview | "I checked for missing headers" | "I built a detection pipeline and can walk through how I'd tune false-positive thresholds, extend it with GeoIP/Sigma rules, or wire it into a real SIEM" |
## Development
```bash
pip install -r requirements-dev.txt
pytest tests/ -v # run the test suite
black . # format code
flake8 . --max-line-length=120 # lint
```
See [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines on adding new
detectors, and [SECURITY.md](SECURITY.md) for the project's security
scope and reporting process.
## Legal note
This tool only reads log files you provide — it doesn't scan or contact
any external systems. The sample data is entirely synthetic. If you point
it at real production logs, treat the dashboard and any generated reports
as sensitive (they may reveal attack patterns you don't want public).