Guardian-SIEM - Defensive Security SIEM School Project

项目说明

🛡️ Guardian SIEM

Guardian is a lightweight, modular Security Information and Event Management (SIEM) system written in Python. It detects Denial of Service (DoS) attacks and Network Scanning in real-time, automatically mitigating threats and notifying administrators .

✨ Features

Multi- Detection:

- TCP SYN Floods (DoS)
- UDP / ICMP Floods (Bandwidth Exhaustion)
- Port Scanning (Reconnaissance detection via Nmap)

Acti: Automatically blocks IPs using iptables (Linux Kernel Firewall).

Smart Escalation (Strike System):

- Strike 1: Warning (60s ban)
- Strike 2: Severe (10m ban)
- Strike 3: Jail (24h ban)

Traffic Analysis: Distinguishes between massi attempts (Flood) and distributed port touching (Scan).

Smart Whitelisting: Automatically ignores local Gateway, DNS servers (1.1.1.1, 8.8.8.8), and legitimate traffic replies.

Persistence: Bans survi restarts (bans.json).

📂 Project Structure

🚀 Installation

Clone the repository:

Install System Tools: You need iptables for blocking and hping3/nmap for testing.

Install Python Dependencies:

⚙️ Configuration

1. Secrets (.env)

Create a .env file in the root directory to store your Discord Webhook securely.

2. Settings (config/settings.yaml)

Adjust detection sensitivity in config/settings.yaml.

🧪 Local Testing Guide (Safe Mode)

To demonstrate the SIEM on a single machine, follow this protocol strictly to avoid locking yourself out of your own computer.

Step 1: Configure for Localhost

Open config/settings.yaml and set the interface to loopback:

Step 2: Run Guardian

Run with sudo (required for packet sniffing and iptables).

Step 3: Simulate Attacks

Open a second terminal and run these commands.

1. Port Scan Simulation
Mimics a hacker scanning for open .

✅ Expected Result: [!!!] DETECTED Port Scan FROM 127.0.0.1

2. SYN Flood Simulation

Mimics a botnet flooding connections.

✅ Expected Result: [!!!] DETECTED SYN Flood FROM 127.0.0.1

3. UDP Flood Simulation

Mimics bandwidth exhaustion.

✅ Expected Result: [!!!] DETECTED UDP Flood FROM 127.0.0.1

4. ICMP Flood Simulation

Mimics bandwidth exhaustion.

✅ Expected Result: [!!!] DETECTED ICMP Flood FROM 127.0.0.1

5. DNS Resolution Simulation

Simulate a DNS resolution.

✅ Expected Result: DNS entry is logged in logs/dns_traffic.json

5. DNS Resolution Simulation

Simulate a DNS resolution.

✅ Expected Result: HTTP user-agent is logged in logs/http_traffic.json

📊 Real-Time Dashboard (Web Interface)

Guardian includes a professional-grade dashboard to monitor network traffic, protocol distribution, and active bans in real-time.

Usage

Run the dashboard in a separate terminal while Guardian is active:

Key Features:

Li Load: packet (PPS) for TCP/UDP/ICMP.

Threat Intelligence: Displays top User-Agents and DNS queries.

Jail Monitor: Tracks active IP bans with countdown timers.

Auto-Refresh: Updates every 2 seconds without page reload.

🆘 Panic Button (Reset)

If your internet stops working, or you cannot use sudo because you banned 127.0.0.1, run these commands to reset:

Stop the script (Ctrl+C).

Flush the firewall:

Delete the ban persistence file:

⚠️ Legal Disclaimer

This tool is for Defensi Purposes Only. Do not use hping3 or attack tools on networks you do not own. The author is not responsible for misuse.

项目信息

开发语言：Python

Star 数：1

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Defensive Security SIEM School Project展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。