🛡️ Castle Defense - Live SIEM & SOAR

Castle Defense is a Python-based terminal application that acts as a mini SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation, and Response) tool. It performs live monitoring of system log files, detects threats based on a configurable ruleset, and performs automated defensive actions, such as temporarily blocking malicious IP addresses.

This tool was converted from a simulator to a live monitoring utility that can be used to protect a real system from basic attacks.

Features

• Live Log Monitoring: Tails a specified log file (e.g., /var/log/auth.log) in real-time.
• Rule-Based Threat Detection: Uses a simple, configurable rules.txt file to detect threats.
  • IP/Keyword Matching: Flags logs containing specific IPs or keywords.
  • Brute-Force Detection: Identifies multiple failed login attempts from a single IP in a short time.
• Automated Response (SOAR): Automatically issues temporary blocks on IPs associated with CRITICAL threats.
• Real-time UI: Displays active blocks, detected threats, and live log entries in a clean terminal interface.

---

Prerequisites

Before you begin, ensure you have the following installed on your system (these instructions are for Debian-based systems like Kali or Ubuntu):

• Python 3: sudo apt-get install python3
• OpenSSH Server: To provide a service to attack and monitor.

  sudo apt-get install openssh-server
  sudo systemctl start ssh

• sshpass: To easily simulate a brute-force attack.

  sudo apt-get install sshpass

---

Setup & Running

1. Configure the Log File (If Necessary)

The application is configured to monitor /var/log/auth.log by default. If your SSH logs are located elsewhere, change the LOG_FILE variable at the top of the castle_defense.py script.

2. Configure SSH Port (If Necessary)

This tool does not require a specific SSH port, but you need to know which port your SSH server is running on to attack it. Check the status of the SSH service to find the port:

sudo systemctl status ssh

Look for a line like Server listening on 0.0.0.0 port 22. If your port is not 22, you will need to specify it during the attack phase.

3. Run the Monitor

Because the tool needs to read protected system logs, it must be run with sudo.

sudo python3 castle_defense.py

The application will start, and you will see the live monitoring interface.

4. Test with a Brute-Force Attack

Open a second terminal and use the following command to simulate a brute-force attack. This will generate failed login attempts that the monitor will detect.

Important: Replace 22 with your actual SSH port if it's different.

for i in {1..5}; do sshpass -p "fakepass$i" ssh -o StrictHostKeyChecking=no -p 22 fakeuser@127.0.0.1; done

Watch the Castle Defense terminal. You will see "Failed password" alerts appear. After enough attempts, the brute-force rule will trigger a CRITICAL alert, and the SOAR function will automatically create a temporary block on the attacker's IP (127.0.0.1).

---

Customizing Rules

You can add your own detection rules to rules.txt. The format is CSV-based:

• IP, <IP_ADDRESS>, <SEVERITY>
• KEYWORD, <KEYWORD>, <SEVERITY>
• BRUTE_FORCE, <ATTEMPTS>, <SECONDS>, <SEVERITY>

Example rules.txt:

# Block a known bad IP
IP, 203.0.113.4, LOW

# Flag a dangerous keyword
KEYWORD, exploit, CRITICAL

# Detect a brute-force attack: 4 attempts in 60 seconds
BRUTE_FORCE, 4, 60, CRITICAL