Production engineering patterns for SOC log parsing, alert correlation, and response automation.
🌐 Visit the site → www.logparsing.com
LogParsing.com is a deep, code-backed knowledge base for the engineers who keep a Security Operations Center running: SOC analysts, security engineers, Python automation developers, and platform/DevOps teams. It treats ingestion, parsing, normalization, correlation, and response as a layered engineering discipline — not a set of vendor knobs — so detection coverage scales with telemetry volume instead of collapsing under it.
Every guide pairs architectural reasoning with runnable, fully-typed, async Python you can copy into a real pipeline. Diagrams are hand-authored, structured data is first-class, and each page maps its patterns to the compliance frameworks (NIST, ISO/IEC 27001, PCI-DSS) and MITRE ATT&CK techniques a production team is actually assessed against.
- Real implementations, not pseudocode. Bounded-queue ingestion, schema-validated normalization, stateful correlation windows, idempotent SOAR actions — each as a self-contained, production-grade Python module.
- Failure-mode first. Every technique documents its error-code taxonomy, dead-letter routing, and back-pressure behavior, because the interesting part of a SOC pipeline is what happens when things break.
- Grounded in standards. Elastic Common Schema (ECS) and OSSEM field mapping, RFC 5424 syslog, STIX 2.1, MITRE ATT&CK, and the NIST/ISO/PCI controls that govern log management and incident response.
- Built for depth. 50+ interlinked guides organized so you can start at an overview and drill straight into the exact edge case you're fighting.
| Area | What it covers |
|---|---|
| Log Ingestion & Parsing Workflows | Stage-gate pipelines for Syslog/JSON/CSV, schema validation, async batching, rate limiting, and error categorization. |
| SOC Log Architecture & Taxonomy | Deterministic taxonomies, syslog RFC discipline, JSON normalization, ECS/OSSEM mapping, and threat-intel feed mapping. |
| Alert Correlation & Rule Engines | Cross-source event linking, temporal correlation windows, MITRE ATT&CK integration, dynamic severity scoring, and false-positive reduction. |
| SOAR Playbook & Response Automation | Durable playbook orchestration, severity-aware alert routing, idempotent automated ticketing, and fail-open case enrichment. |
- Build a stage-gate SOC log ingestion pipeline
- Cross-source event linking across telemetry
- Event-time temporal correlation windows
- Durable, idempotent SOAR playbook engines
- Regex vs structured parsing performance
A static site generated with Eleventy, authored in Markdown with hand-written inline SVG diagrams and JSON-LD structured data, and deployed to Cloudflare Pages.
npm install # install dependencies
npm run build # build the static site into _site/
npm run serve # local dev server with live reload
npm run deploy # build and deploy to Cloudflare PagesSpotted an error, an outdated technique, or a gap in coverage? Open an issue on GitHub. Suggestions for new guides and edge cases are welcome.
Explore the full library at www.logparsing.com →
Maintained by Log Parsing