Cybersecurity Log Analysis and Incident Management

We developed a cybersecurity log analysis system that tracks user activity, login attempts, and security incidents such as brute force attacks. The project involved creating a comprehensive database to store user information, activity logs, and security incidents, with the ability to detect patterns such as repeated failed login attempts. The system uses SQL Server to process log data, with stored procedures and triggers for improved performance and automation.

Key Features:

A relational database architecture was designed and implemented, including tables for:

Users (storing user credentials, roles, and account information).

Activity Logs (tracking user actions such as login, logoff, and failed attempts).

Security Incidents (capturing attack details such as brute force attacks, SQL injections, etc.).

Stored Procedures for:

Registering new users with hashed passwords and security tokens for secure login. Securely log users in by comparing the entered password with the stored hash.

Retrieve the most vulnerable IP addresses to monitor potential threats.

Trigger to monitor failed login attempts:

Automatically logs brute force attacks if more than 5 failed login attempts are detected from a specific IP address within 30 minutes.

Complex queries to generate reports on:

Security incidents by attack type.

Most vulnerable IP addresses based on attack frequency.

Result:

Successfully implement a user authentication system with secure password hashing and salting.

Develop an automated incident detection system using triggers and stored procedures.

Demonstrate the ability to design a comprehensive cybersecurity database with preventative and heuristic security features.

Gain practical experience in SQL Server administration, T-SQL scripting, and cybersecurity practices in database systems.

Technologies used: SQL Server, T-SQL, Stored Procedures, Triggers, Data Encryption (SHA-512), Cybersecurity Concepts