Built by Astha Patel | M.S. Information Technology, Arizona State University
I kept reading about how enterprise SOC teams work, threat feeds, detection engines, incident pipelines, and I wanted to actually build one rather than just study it. Most beginner security projects use static fake data. I wanted something that pulled real threat intelligence from the same sources real analysts use every day.
CyberShield is the result. It is a fully functioning SOC platform that ingests live malicious indicators, detects threats in real time, auto-generates incidents, and displays everything on a live dashboard.
CyberShield has five components that work together end to end.
| Component | What It Does |
|---|---|
| Threat Intelligence Engine | Pulls live IOCs from 3 real industry feeds every hour |
| Attack Detection Engine | Cross-references submitted IPs and domains against 150,000 plus threat indicators |
| Automated Incident Response | Auto-creates incidents with unique IDs and logs all detections |
| Live SOC Dashboard | Flask dashboard that auto-refreshes every 30 seconds |
| PDF Report Generator | Auto-generates professional incident reports |
This is not simulated. CyberShield pulls from three live public threat feeds.
URLhaus (Abuse.ch) for active malware distribution URLs, AlienVault OTX for multi-type threat intelligence from a global community, and Feodo Tracker (Abuse.ch) for Banking Trojan command and control servers.
These are the same feeds used by real enterprise SOC teams. The database currently holds 150,000 plus live malicious indicators.
Python 3, Flask, SQLite, AlienVault OTX API, URLhaus API, Feodo Tracker, ReportLab
git clone https://github.com/astha2310/cybershield.git
cd cybershield
pip3 install flask requests colorama reportlab python-dotenv schedule
python3 threat_intel/database.py
python3 threat_intel/feed_collector.py
python3 detection/detector.py
python3 dashboard/app.pyThen open http://127.0.0.1:8080 in your browser.
cybershield/
threat_intel/
database.py
feed_collector.py
detection/
detector.py
dashboard/
app.py
data/
cybershield.db
logs/
detections.log
README.md
Building this taught me things no course covers. Pulling from live APIs means dealing with inconsistent data formats, rate limits, and feeds that go down without warning. The detection engine needed to be fast enough to cross-reference submissions against 150,000 plus records without bottlenecking the dashboard.
The most surprising finding: the overlap between feeds is smaller than you would expect. AlienVault, URLhaus, and Feodo Tracker rarely flag the same indicators. Real threat coverage requires multiple sources.
SIEM integration to forward detections to ELK or Splunk, email alerting for high-severity incidents, automated firewall rule generation from confirmed IOCs, IP geolocation visualization, and historical trend analysis.
CyberShield is built for educational purposes and authorized security research only. All threat data is sourced from public feeds. Do not use against systems you do not own.
Astha Patel | github.com/astha2310 | linkedin.com/in/asthap23