CLX-1042highInitial Access
ConsoleLogin from unusual ASN without MFA for IAM user lab-analyst.
06:12:04Z · AWS GuardDuty
Back to Neural ArchiveRepository
Independent project · current
CyberLogX
SIEM-like dashboard for log analysis, AWS findings, and threat detection. Original Django app on GitHub; this page is the live operator view with Docker/Kubernetes health and an on-device AI-style rule engine.
Events / 24h
18,442
Open high+
7
AWS findings
3
AI reviews
12
Threat feed
CLX-1043criticalPersistence
iam:CreateAccessKey on unused role SOCLabRunner in eu-west-2.
06:14:21Z · CloudTrail
CLX-1044mediumCommand and Control
Repeated egress to 185.244.25.0/24 on TCP/4444 from eks-node-03.
06:18:09Z · VPC Flow
CLX-1045highPrivilege Escalation
Unauthorized attempt to bind cluster-admin from service account ci-bot.
06:21:44Z · kube-audit
CLX-1046lowCredential Access
8 failed SSH logins then a successful sudo from jump-host.
06:26:11Z · Auth logs
Log analysis workbench
Paste syslog / CloudTrail / VPC flow / kube-audit. Scoring stays in the browser so nothing is stored.
medium
Brute-force / invalid account
Repeated auth failures. Check source IP, then lock out or tarpit — don't jump to a blocklist on one hit.
high
AWS console without MFA
GuardDuty-shaped IAM finding. Enforce MFA and alert on ConsoleLogin from a new ASN.
critical
Privilege / persistence API
IAM or S3 policy change from a lab role that should be idle. Review the CloudTrail actor before anything else.
high
Possible C2 or crypto-miner
Suspicious egress port or mining-pool DNS. Isolate the workload, then grab process list / conntrack.
high
Kubernetes privilege attempt
kube-audit shows a bind or secret read that the lab RBAC baseline should deny.