Blue Watch, Day 4-6: From Alerts to a Story

Short summary

Blue Watch is a mini-SIEM project that progressed from raw alert detection to incident scoring and timeline reconstruction. The scorer unifies alerts by mapping IPs to users and attributing each alert to a single entity, then sums severity points into LOW/MEDIUM/HIGH/CRITICAL levels. A timeline module sorts events chronologically using ISO 8601 string sorting, producing a full 12-event attack story with harmless noise correctly left quiet.

• •Scorer.py unifies alerts by entity using IP-to-user mapping and fallback chains
• •Severity scoring converts alert piles into triageable levels (LOW to CRITICAL)
• •Timeline.py builds chronological incident story from sorted events

Generated with AI, which can make mistakes.