A MEAN-stack SIEM platform combining a normalized, multi-source threat-scoring backend with a custom recon toolkit - built to extend network security monitoring coverage ahead of India's G20 Summit.

The Challenge

The 6-engineer team had limited developer bandwidth for feature work: 2 were deployed on-site with clients and needed remote coordination, 2 were Linux administrators not positioned to build features, and one was a junior with limited MEAN-stack experience - leaving feature development to carry mostly solo. Reputation-based threat-intel lookups alone weren't enough coverage for the security bar the G20 Summit required; the platform needed direct reconnaissance capability too, not just known-bad lookups.

Key Decisions & Tradeoffs

• Built an Express backend that normalizes threat signals from 10 independent sources (AbuseIPDB, VirusTotal, AlienVault, Binary Defence, BOTVIJ, BruteForce Blocker, CI Army List, CIRCL BGP Ranking, HoneyDB, Maltiverse) onto a common 0-1 scale, each with its own source-specific scoring heuristic, then averaged into a single threat score per IOC.
• Built a network discovery tool from scratch using python-nmap for host-alive checks, OS detection, open-port scanning, and service-version fingerprinting - learning ICMP-level networking to implement it, delivered in 2 months.
• Built a malware-URL matcher pulling the live feed from urlhaus.abuse.ch and indexing it in a Trie data structure, avoiding slow sequential search against a large and growing URL list.
• Built a page-level web crawler (requests + BeautifulSoup) to detect redirects and enumerate external script sources on a target page, rather than relying on reputation data alone.
• Integrated knockpy, an existing open-source subdomain enumeration tool, for subdomain exposure scanning - rather than duplicating a solid existing tool from scratch.
• Built a pure-shell-scripting IOC recon tool (using only built-in Linux tools like netstat, ip, arp) extracting IPs and domains from local traffic in under 2 seconds, with zero external binaries or Python dependencies, outputting SIEM-ready JSON matching the team's MongoDB ingestion schema.
• Coordinated with 2 client-deployed engineers remotely and supported a junior developer ramping up on the MEAN stack, while carrying the majority of feature development given the rest of the team's limited availability.

Outcome

Delivered ahead of the G20 Summit's network security requirements, combining reputation-based threat scoring with live reconnaissance capability the API-lookup-only approach couldn't provide. Became a go-to lightweight tool for field teams needing rapid, offline network recon.

Backend threat-scoring engine and toolkit repos: websiem-update, sessn_project_backend, ioc-intel-tools.