Argus — formerly SOC Simulator
LIVEA self-hostable SIEM that ships with its own APT killchain generator to prove the detections work.
Argus is a self-hostable SIEM (Security Information and Event Management platform) that ingests real logs, runs Sigma detection rules against them, and drives threat-hunting and incident-response workflows mapped to MITRE ATT&CK.
The problem
Learning and validating detections usually means either paying for a commercial SIEM or wiring up a lab by hand and hoping the data you feed it resembles a real attack. Neither gives you a tight loop between writing a detection and confirming it fires on the technique it targets.
The approach
Argus ingests logs over syslog, HTTP, and file sources, and evaluates them with Sigma rules through an AST-based query parser rather than fragile string matching. Hunting and incident-response workflows are mapped to MITRE ATT&CK so investigation follows the same language analysts use.
The piece that ties it together is a synthetic APT killchain generator: it emits a realistic multi-stage attack so a detection can be validated end to end, from ingestion to alert, without needing a live adversary.