A professional Security Operations Center (SOC) dashboard for monitoring authentication attacks, blocking malicious IPs, and detecting anomalies using machine learning.
- ✅ Secure login system with session management
- ✅ Role-based access control (Admin, Analyst)
- ✅ Session tracking and user management
- ✅ Password hashing with werkzeug security
- ✅ Live security metrics and KPIs
- ✅ Failed login attempt tracking
- ✅ Unique attacker IP detection
- ✅ ML anomaly detection
- ✅ Auto-refreshing data (5-second intervals)
- ✅ Brute force attack detection
- ✅ Automatic IP blocking & firewall integration
- ✅ GeoIP location tracking
- ✅ ML-based anomaly detection
- ✅ Real-time log monitoring
- ✅ Modern dark-themed dashboard design
- ✅ Responsive design (mobile, tablet, desktop)
- ✅ Professional styling with gradient accents
- ✅ Multiple pages: Dashboard, Incidents, Analytics, Admin Panel
- ✅ User profile management
pip install -r requirements.txtpython run_app.pyThe application will start on: http://localhost:5000
Admin Account:
Username: admin
Password: admin123
Analyst Account:
Username: analyst
Password: analyst123
smart-auth-soc/
├── web/
│ ├── app.py # Main Flask application
│ ├── users.json # User database
│ └── templates/ # HTML templates
│ ├── login.html # Login page
│ ├── dashboard.html # Main dashboard
│ ├── incidents.html # Security incidents
│ ├── analytics.html # Analytics & metrics
│ ├── profile.html # User profile
│ ├── admin.html # Admin panel
│ ├── 404.html # 404 error page
│ └── 500.html # 500 error page
│
├── app/
│ ├── monitor.py # Real-time log monitoring
│ ├── config.py # Configuration
│ ├── analytics.py # Data analytics
│ ├── firewall.py # IP blocking
│ ├── ml_engine.py # ML anomaly detection
│ └── geoip.py # GeoIP lookups
│
├── sample_logs/ # Authentication logs
├── soc_data.json # Real-time metrics
├── requirements.txt # Python dependencies
├── run_app.py # Application entry point
└── README.md # This file
- 4 key metrics: Failed Attempts, Unique IPs, Blocked IPs, ML Alerts
- Real-time blocked IP table
- Auto-refresh every 5 seconds
- Responsive grid layout
- Severity-based filtering (Critical, High, Medium)
- Card-based incident display
- Location information for each threat
- Reason for blocking
- Historical metrics
- Key performance indicators (KPIs)
- Block rate and detection rate calculations
- System status overview
- User management
- System configuration overview
- Security settings
- User roles and permissions
- Real-time user count
- Account information
- User permissions
- Account status
- Role information
- Secure session management with random session IDs
- Password hashing using werkzeug.security
- Login attempt logging
- Session timeout support
- Role-based access control
- Admin-only endpoints
- Login requirement decorators
- User data stored securely
- JSON-based local storage (can be upgraded to database)
- Audit logging for all login attempts
The system can be integrated with monitor.py for real-time log monitoring:
# In a separate terminal
python -m app.monitorThis will:
- Watch
/sample_logs/web_auth.logfor failed login attempts - Detect brute force patterns
- Block IPs at the firewall level
- Execute ML anomaly detection
- Update
soc_data.jsonwith metrics
Edit app/config.py to customize:
TIME_WINDOW = 60 # Seconds to track login attempts
ATTEMPT_THRESHOLD = 5 # Attempts before blocking
LOG_FILE_PATH = "..." # Path to auth logs
GEOIP_API = "..." # GeoIP service endpointAuth Logs → Monitor → Analytics → Firewall Block
↓ ↓ ↓ ↓
Parsing Detection Metrics Database
↓ ↓ ↓ ↓
Pattern ML Check soc_data.json Updates
↓ ↓ ↓ ↓
Blocking Anomaly Dashboard Reports
- Gradient Backgrounds: Modern cyan-blue color scheme
- Dark Theme: Professional SOC aesthetic
- Responsive Design: Works on all screen sizes
- Interactive Elements: Hover effects, animations
- Real-time Updates: Auto-refresh without page reload
- Severity Colors: Visual indicators for threat levels
- 🔴 CRITICAL (Red)
- 🟠 HIGH (Orange)
- 🟡 MEDIUM (Yellow)
POST /login- User loginGET /- Redirect to dashboard or login
GET /dashboard- Main dashboardGET /incidents- Security incidents pageGET /analytics- Analytics pageGET /profile- User profileGET /logout- Logout user
GET /admin- Admin panelGET /api/users- List all users
GET /api/dashboard-data- Current metrics (JSON)GET /api/blocked-ips- Blocked IP list (JSON)
python run_app.py
# Server running on http://localhost:5000python -m app.monitor
# Watching for authentication log eventsThen open your browser to: http://localhost:5000
The monitoring system expects logs in this format:
Mar 04 14:23:45 server sshd: Failed password for admin from 192.168.1.100
Mar 04 14:23:50 server sshd: Failed password for admin from 192.168.1.100
# Create virtual environment
python -m venv .venv
# Activate virtual environment
.venv\Scripts\activate
# Install dependencies
pip install -r requirements.txt
# Run application
python run_app.py# Create virtual environment
python3 -m venv .venv
# Activate virtual environment
source .venv/bin/activate
# Install dependencies
pip install -r requirements.txt
# Run application
python run_app.py- flask (2.3.3) - Web framework
- werkzeug (2.3.7) - Security utilities
- scikit-learn (1.3.1) - Machine learning
- numpy (1.24.3) - Numerical computing
- requests (2.31.0) - HTTP client
- colorama (0.4.6) - Colored terminal output
- Database integration (PostgreSQL/MySQL)
- Advanced charting with Chart.js
- Email/Slack notifications
- LDAP/Active Directory integration
- Custom report generation
- Machine learning model improvements
- Multi-factor authentication (MFA)
- API key authentication
- Webhook integrations
- Docker containerization
This project is for educational and demonstration purposes.
For issues or questions, please check the documentation or create an issue in the repository.
Prince Kashyap
🎓 MCA (Hons.) AI/ML Student – Lovely Professional University
🔐 Cybersecurity & Ethical Hacking Enthusiast
💻 Interested in SOC Operations, Threat Detection & Security Automation
- GitHub: https://github.com/Prince-7626
- Email: prince201kashyap@gmail.com
Status: ✅ Complete & Production-Ready for Demo
Last Updated: March 4, 2026
Version: 1.0.0