Developer Builds Mini-SIEM That Turns Scattered Alerts Into a Unified Attack Story

A developer working on a personal security project called Blue Watch has completed days four through six of building a mini Security Information and Event Management (SIEM) system. The project's earlier phases produced a log parser and rules-based detector that correctly flagged four alerts from a simulated attack scenario involving brute-forcing, backdoor user creation, and sensitive file access. The latest work focused on a scoring module called scorer.py, which links alerts from different IPs and usernames to a single attacker entity and assigns a cumulative severity level, reaching CRITICAL in the test scenario. A separate timeline module then arranges all events in chronological order, helping distinguish genuine attack activity from harmless normal logins occurring at the same time. The result is a system that converts isolated, context-free alerts into a coherent, ordered incident narrative ready for human triage.