Blue Watch: in all its glory

Spent the last few weeks building something I've wanted to understand properly for a while: how a SIEM actually thinks.

Not using one. Building one.

Blue Watch is a mini SIEM I built from scratch in Python. No fancy platform, no black box, just logs, regex, and a lot of "wait, why isn't this matching."

Here's what building it actually taught me:

Logs are messy. Every source speaks its own language, sshd says one thing, sudo says another, Apache says something else entirely. Parsing is just teaching Python to translate all of it into one shared vocabulary.

Normalization is the real magic. Once every event looks the same underneath (same fields, same shape), detection stops caring where the log came from. Write one rule, it works everywhere.

Automation is just patience, structured. Rules living in a config file instead of buried in code meant I could add a whole new log source later without touching my detection logic at all. Past me set that up without even realizing how much time it'd save future me.

Turns out good architecture is a bit like good code and good rhyme,
get the structure right once, and it'll scale with time.

Genuinely one of the more satisfying builds I've done. Watching a brute force attack chain get reconstructed automatically, timestamped, scored, and MITRE-tagged, from a file I wrote myself, hit different.

If you're learning security or building your own detection tooling, what's the one concept that finally "clicked" for you the way normalization did for me?
Go check it out yourself :)