Self-hosted network security monitoring stack built on a Raspberry Pi 5, applying coursework concepts against live traffic on a real network.
- Building structured log review workflows: triaging Suricata alerts, tracing full network conversations by flow ID, and identifying beaconing patterns to separate normal background traffic from anomalies worth investigating
Deep dive: How it works and why this project
How it works
Suricata runs as a network intrusion detection system (NIDS) in promiscuous mode on the Pi's ethernet interface, capturing every packet on the network via libpcap and writing structured EVE JSON logs. Promtail tails those logs and ships them to Loki, a label-indexed log database, where events are queryable with LogQL. CrowdSec analyzes the same logs against behavioral scenarios, enriches events with crowdsourced threat intelligence ratings, and enforces IP blocks through a firewall bouncer on nftables. Grafana sits on top as the visualization layer, with dashboards for DNS traffic analysis, Suricata alerts, and flow inspection. Remote administration runs over Tailscale.
Why this project
Cybersecurity grew out of developers writing better, more careful code - the complete opposite of the vibe-coded years before it. This lab is the pivot point: every component was configured by hand, validated end to end, and is understood down to the packet level. The most complex challenges are the most rewarding ones.