AEGIS-LEGION
Timileyin Abioye
Case study
AEGIS-LEGION
Cloud threat detection & incident response platform
An independently built SOC platform combining host telemetry, rule-based detection, machine-learning anomaly detection, real-time incident management, and analyst collaboration in a unified interface.
AuthorSolo project
TimelineDec 2025 — present
DisciplineSecurity engineering
ScopeFull stack
FastAPIPythonReactPostgreSQLIsolation ForestSSEJWTRBAC
Launch live system View source Watch walkthrough
Why I built it
A SOC dashboard I'd actually want to use.
I started AEGIS-LEGION in December 2025 with a simple idea: build the kind of security operations environment I would want to use myself.
I wanted a dashboard that felt approachable for newer analysts without becoming limiting for experienced ones. Monitoring, detection, incident response, and collaboration should feel like one system rather than a pile of disconnected tools.
That meant treating usability as part of the security-engineering problem, not an afterthought.
Observe
Real-time host telemetry and continuous infrastructure health monitoring.
Detect
Deterministic rules complemented by machine-learning anomaly detection.
Collaborate
Incident assignment, investigation discussion, and familiar @mention notifications.
Working conditions
Built under constraint.
Engineering is about managing constraints, not explaining them away.
One engineer
Solo
Architecture, backend, frontend, security review, machine learning, and deployment were all handled independently.
Project budget
$0.00
Free-tier hosting, open-source databases, and containerized agents throughout.
Delivery
Side project
Built asynchronously, alongside a full-time role and other research work.
Scope
Multi-domain
Required research across cloud hosting, telemetry loops, anomaly baselines, JWT boundaries, and SSE streaming.
System design
Architecture
Lightweight telemetry sources feed the rule and machine-learning engines, which route events through real-time notifications directly to the analyst interface.
Data and control flow, top to bottom
Monitored host
Linux / macOS / Windows
Telemetry: CPU, memory, disk, network, process state, collected via psutil.
API key auth, rate limited
Python agent
Continuous telemetry collection
Signed telemetry payloads pushed to the backend via REST.
FastAPI backend
JWT session auth and tenant isolation
Rule-based detection
Deterministic logic evaluating single- and multi-host telemetry against known thresholds and signatures.
Isolation Forest
Unsupervised anomaly scoring over a five-dimensional feature vector; learns a baseline and flags deviations.
PostgreSQL
Incidents and telemetry schema
Stores incident state, telemetry history, audit trails, and user associations.
Incident pipeline
Org-scoped SSE
Server-sent event stream
Events filtered by organization boundary to prevent cross-tenant leakage.
React console
Analyst dashboard
JWT authRBAC check
Triage & assign
Incident chat
Telemetry ingest
ML approval
Telemetry layer
Real telemetry, synthetic attacks.
The monitoring agent collects genuine host telemetry using the psutil library — CPU usage, memory allocation, disk status, network connections, and active processes.
A separate, optional demo event generator simulates security incidents — login spikes, unauthorized API requests, threshold breaches — rather than running genuine attacks against the live system.
That separation lets me test rules and validate the model without introducing real vulnerability risk into the host runtime.
Workflow design
Security operations are collaborative.
Detection is only the start of an incident workflow. AEGIS treats an incident as a shared workspace where analysts can assign responsibility, preserve investigation context, and bring colleagues in with familiar @mentions.
Assignment and status state transitions.
Live discussion logs attached directly to incident cards.
Real-time notifications for mentioned users.
Preserved investigation artifacts, notes, and metrics.
Anomaly detection
ML, without the hype.
AEGIS uses unsupervised anomaly detection as a complement to deterministic rules — not a replacement for security logic.
Baseline and inference
Unsupervised anomaly detection uses an Isolation Forest model over a five-dimensional host telemetry feature vector to establish a baseline of normal activity.
To avoid noise and false alarms, the model starts in a training buffer, gathering data before entering inference mode. Baseline calibrations are reviewed and approved before inference alerts reach the live incident pipeline.
Known conditions
Rule engine
Hybrid detection
Unknown deviations
Isolation Forest
Hardening
Building the security platform securely.
Multi-perspective review: the code went through my own review, anonymous academic reviewer feedback, peer review from another security professional, and AI-assisted source analysis. Findings were remediated and verified with automated regression tests.
Security finding 01
Cross-tenant real-time event isolation
Finding
The original Server-Sent Events (SSE) broadcaster used a global, single-channel subscription model.
Risk
Authenticated users could potentially receive live incident event streams belonging to other organizations.
Fix
Subscriptions and event publishing were partitioned by organization identity; missing identity checks fail closed.
Verification
Tenant-isolation regression tests were added to verify that Organization A cannot receive Organization B's events.
Security finding 02
Authentication & session hardening
Password security
Bcrypt-backed hashing implemented on all credentials, with a migration path for legacy password hashes.
Token purpose
Strict credential validation: password-reset tokens are explicitly rejected if submitted as normal session credentials.
Account state
Disabled account profiles immediately terminate active sessions and lose all corresponding API ingest access.
Abuse resistance
IP-based and account-based rate limiting is configured on authentication, session creation, and reset routes.
Test coverage
Verify the fix.
Security requires automation — logical boundaries get checked on every push to main.
Backend unit & integration coverage
· Authentication bounds
· Event ingestion logic
· RBAC restrictions
· Detection rules
· Incident status loops
· Tenant SSE channels
CI pipeline: GitHub Actions runs backend pytest suites and verifies the production client bundle on pull requests to main, with advisory dependency auditing for deprecations.
Failure log
Things that went wrong.
Each one forced an architectural correction.
Database persistence & schema
Schema scaling conflicts during ingestion spikes forced a redesign of data relationships and transaction handling in PostgreSQL.
Tenant authorization leaks
Early reviews found event leakage in raw global streams, which meant adding explicit database and pub/sub security boundaries.
ML baseline noise
Initial Isolation Forest baselines flagged ordinary CPU idle activity as critical anomalies. Fixed by adding baselining buffers and filters.
Hosted runtime differences
Deploying to Vercel/Render surfaced persistent-state issues that hadn't shown up in the local Docker environment.
Retrospective
What I learned.
Security is about boundaries
Authentication just checks identity. Real security relies on explicit, fail-closed authorization boundaries applied to data records, queries, notifications, and streams.
ML needs operational context
An anomaly score is just a number. Machine learning flags deviations, but it only becomes useful to an analyst once it's mapped into a clear, triage-friendly incident pipeline.
UX matters in security
Securing systems means making quick decisions under stress. Approachable, collaborative workspaces cut down on triage fatigue and speed up resolution.
Building teaches differently
Reading gives you frameworks, but writing configuration files, debugging schema issues, and breaking boundaries shows you exactly how systems fail.
Interfaces
Product assets
Welcome notification with workspace assignment details.
API key creation notification email.
Multi-tenant registration console.
Analyst session login.
Admin tenant management and identity settings.
Global dashboard summarizing threat levels.
Demo
Product walkthrough
The system operating as a unified workspace rather than a set of static screens.
Status
Live and actively tested.
AEGIS-LEGION is currently deployed as a portfolio and demonstration platform, and has been tested by several colleagues during development and evaluation.
Designed
Engineered
Tested
Deployed
Like this project
Posted Sep 24, 2026
Full case study of AEGIS-LEGION: a solo-built SOC platform with telemetry ingest, rule + ML detection, real-time SSE incidents, and analyst collaboration.
