LogParsing

A self-contained Python module mapping MISP attributes and objects onto ECS threat.indicator fields - type resolution, category handling, dedup, error codes, and DLQ-safe routing for SOC enrichment.

Stop STIX/TAXII ingestion from flooding your SIEM - an async TAXII 2.1 poller with modified_after windowing, STIX 2.1 pattern flattening to typed indicators, confidence-to-severity mapping, TTL decay, an ERR_STIX error-code table, and a dead-letter path f

A self-contained Python pattern for bounding threat-intel enrichment latency in real-time SOC correlation - tiered caches, per-lookup deadlines, budget accounting, error codes, and fail-open routing.

A self-contained Python crosswalk between Elastic ECS and OSSEM field names - concrete field-by-field mapping, conflict handling, bidirectional projection, error codes, and DLQ-safe routing.

Collapse AWS CloudTrail, Azure Activity, and GCP Audit JSON into one canonical event model for SOC correlation - provider-agnostic field extraction, timestamp and type coercion, deterministic action mapping, and error-coded DLQ routing with an async Pydan

Deterministically translate ArcSight-style CEF events into Elastic Common Schema in Python - header decode, contextual cs/cn extension routing, strict type coercion to ip/long/date, an ERR_CEF error-code reference, and a dead-letter path for malformed pay

A self-contained Python benchmark quantifying regex versus structured log parsing - throughput, catastrophic backtracking, memory, correctness, error codes, and safe-timeout DLQ routing.

Turn Sigma YAML attack. tags into validated MITRE ATT&CK technique and tactic metadata as a CI/CD gate - typed, async-aware Python, an ERR_SIGMA error-code table, and a verification checklist for SOC correlation pipelines.

A self-contained Python routing rule that combines alert severity with resolved asset ownership to dispatch SOC cases to the right responder, with precedence handling, error codes, and DLQ routing.

A decision guide comparing syslog and JSON log ingestion for SOCs - transport reliability, structure, ordering, framing, and a self-contained Python adapter that normalizes both to one schema.