SOC operations center with log analysis, detection engineering, and alert triage for security training.
Part of the Darknode cybersecurity education platform.
Screenshot coming soon
CITADEL is a browser-based Security Operations Center (SOC) simulator built entirely in vanilla JavaScript. It teaches SOC analyst workflows, log analysis, and detection engineering through interactive, realistic scenarios.
- SOC Dashboard -- Real-time alert feed, severity heatmap (24h grid), MTTD/MTTR gauges, analyst workload board
- Log Explorer -- Multi-format log viewer (syslog, JSON, CEF, LEEF, Windows Event, access logs) with search and filtering
- Correlation Engine -- Visual rule builder for event chains (IF event A + event B within N seconds THEN alert)
- Detection Rules -- 40 detection rules with Sigma-style YAML, Splunk SPL, and Elastic KQL conversion
- Alert Triage -- Full workflow: New, Investigating, Escalated, Resolved with evidence collection and notes
- Threat Hunt -- Hypothesis workspace with 12 pre-built hunt queries and finding bookmarks
- Compliance -- Real-time scoring against NIST CSF 2.0, CIS Controls v8, and SOC 2 Type II
- Metrics -- SOC KPIs, alert volume trends, false positive rates, analyst performance, shift handoff reports
- 224 sample log entries across 6 formats for realistic analysis practice
- 15 Sigma rules with full YAML syntax and conversion to Splunk SPL and Elastic KQL
- 8 correlation rules with multi-event conditions and configurable time windows
- 30 alerts with 4-state triage workflow and interactive status transitions
- MITRE ATT&CK coverage matrix with 12 tactics and 60+ techniques
- 8 incident response playbooks with ordered steps
- 10-source log ingestion pipeline with EPS monitoring
- Inline CSS with full theme support (classic, pro-light, pro-dark)
- ES module with
renderCitadel(container)andcleanupCitadel()exports - Zero external dependencies
CITADEL is designed to run inside the Darknode web platform. It can also be imported as a standalone ES module:
import { renderCitadel, cleanupCitadel } from './citadel.js';
renderCitadel(document.getElementById('app'));MIT -- see LICENSE for details.
Built by Darknode