Copyright © 2026 Authors retain the copyright of this article. This article is an open access article distributed under the Creative Commons Attribution License which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.

@article{193011,
        author = {Bhuvanyaa S and Angel S},
        title = {SOC DASHBOARD FOR THREAT INTELLIGENCE AND LOG CORRELATION},
        journal = {International Journal of Innovative Research in Technology},
        year = {2026},
        volume = {12},
        number = {9},
        pages = {3982-3991},
        issn = {2349-6002},
        url = {https://ijirt.org/article?manuscript=193011},
        abstract = {This chapter presents a practical study on the design and implementation of a Security Operations Center (SOC) dashboard for threat intelligence, log analysis, and event correlation using open-source technologies. The system was developed to emulate real-world SOC operations by enabling continuous monitoring, enrichment, and visualization of security events within a controlled research environment. Wazuh SIEM was utilized for centralized log collection and rule-based detection, MongoDB for structured data storage and historical analysis, and FastAPI for exposing security data through RESTful services. Interactive visualization was achieved using Dash and Plotly to provide analysts with clear insight into alerts and Indicators of Compromise (IOCs).
To strengthen detection capabilities, the platform integrates external threat intelligence feeds such as AlienVault OTX and AbuseIPDB. These sources provide reputation-based context that enhances situational awareness and supports faster identification of suspicious network entities. A custom-built correlation engine processes incoming logs against known threat indicators, generating prioritized alerts that assist in proactive incident response while reducing manual investigation effort.
Automation plays a significant role in the proposed architecture. Scheduled ingestion pipelines, Bash-based execution scripts, and periodic threat intelligence updates ensure continuous system operation without requiring constant human supervision. The visualization layer further supports analytical decision-making by presenting attack patterns, severity levels, and event distributions in an intuitive dashboard format.
Overall, this work demonstrates that SOC-grade defensive capabilities can be reproduced using cost-effective and accessible open-source components. By combining log analytics, threat intelligence enrichment, and automated correlation, the proposed system provides a practical foundation for cybersecurity research, academic experimentation, and future development of adaptive security monitoring frameworks.},
        keywords = {},
        month = {February},
        }