PROJECT NOTES / 02
ChainSOC
A three-machine SOC prototype connecting a security event to its digest, IPFS content identifier and local blockchain record.
The question behind the project
An alert tells you something happened. An investigation also needs to know which log was collected and whether its content has changed. ChainSOC explores that evidence trail in a controlled lab.
What I built
- Separated event generation, collection and evidence storage across Target, Watcher and Vault. The documented workflow uses SSH to collect and transfer selected Linux logs.
- Connected log content with a SHA-256 digest, an IPFS CID and a Solidity record on a local Ganache chain. A React dashboard presents events and their evidence identifiers.
- Documented a synthetic event through collection, notification, Vault storage and the printable evidence view.
What came out of it
The project demonstrates the idea of an inspectable evidence trail, with screenshots of detection, storage output and dashboard fields. It helped me separate content integrity from the availability of that content.
What the evidence does—and doesn’t—say
A hash does not prove that the original log was truthful or guarantee that its content stays available. Ganache is a local development chain. The public repository is a documented case study, not a complete runnable deployment; some dashboard interactions are explicitly described as simulations.
What I would improve next
Durable ingestion, explicit tamper testing, encrypted log storage and a reproducible deployment would be the next steps.
From the project
Select a capture to inspect it.
07 / CONTACT
Let’s start with
a conversation.
Have a PFE internship in cybersecurity, networks or infrastructure security? I’d be glad to hear about the work and the team.
Marrakech, Morocco