The original title is "Building Blue Watch: a tiny SIEM with a big attitude" - it has a colon which I need to remove. Let me rewrite it.

Short summary

A developer documents building 'Blue Watch,' a mini SIEM that monitors logs and detects attacks like brute-force logins and privilege escalation. Over several days they learned regex, built threshold-based and sequence-based detection rules, fixed a false-positive bug in privilege-escalation matching, and plan to add aggregate threat scoring per user or IP.

• •Built a mini SIEM with four detection rules covering brute-force, backdoor creation, and shadow file modification
• •Fixed a false positive where timestamp coincidence caused innocent users to be blamed for attacker actions
• •Next step is a scorer module to aggregate individual alerts into a single threat score per user or IP

Generated with AI, which can make mistakes.