Developer Builds Blue Watch, a Lightweight SIEM Tool for Log-Based Threat Detection

A developer has publicly documented the creation of Blue Watch, a small-scale Security Information and Event Management (SIEM) system built out of personal curiosity. The project simulates real attack scenarios — including brute-force logins and privilege escalation — to test whether the tool can accurately distinguish malicious activity from normal user behavior. Over four days, the developer implemented regex-based log parsing, configurable detection rules, and datetime-aware event sequencing to power multiple alert types from shared logic. A key challenge involved fixing a false positive where innocent user activity was incorrectly linked to an attacker's actions due to overlapping timestamps, resolved by adding a same-user condition to relevant rules. The next phase involves building a scoring module that aggregates individual alerts into a single threat score per user or IP address.