SentinelSOC-CLI is a config-driven, rule-based Security Operations Center (SOC) detection tool designed for professional use. It provides standardized alert outputs, supports multiple log sources, and allows dynamic rule configuration — all via a command-line interface (CLI).
- Config-Driven: Change tool behavior without touching the code.
- Multiple Log Sources: Dynamically monitor logs from multiple systems.
- Rule-Based Detection: Enable or disable detection rules easily.
- Standard Alert Schema: Alerts follow industry-style JSON format.
- CLI Interface: Lightweight, professional CLI workflow.
- Extensible: Modular design allows adding new detection modules.
- Professional Logging: Outputs alerts in
output/alerts.json.
- Clone the repository:
git clone https://github.com/Nowfir0369/SentinelSOC-CLI.git
cd SentinelSOC-CLI