Hello r/SideProject community!
I've been investing time into a side project named BREACH :: HARBOR. It's a self-hosted cybersecurity platform crafted to not just fend off threats but to anticipate them. Here's a breakdown:
Currently, its primary functionality revolves around collecting attack data and visualizing it. I'm actively working on adding a notification system next to the Core API.
Finally it should be able to proactively block specific hosts which have a bad score in real time (e.g. a subnet from country X attacking the local network or a remote host in the infrastructure). The Defender should be able to automatically manage blocking rules on the machines it's installed. I have already gathered attack data for hundreds of thousands of attacks, the Collector is on the wild internet for 2 months now.
I genuinely appreciate feedback on the overall concept, workflow, and any essential features you believe should be integrated. I'm also planning to expand its functionalities and, in the future, offer a global threat data service (CloudSync) as a way to monetize. Or hunt any funding to let me invest more time on it and push it a little bit to become more popular as a platform.
Your insights and suggestions will be invaluable! Keep in mind this is a solo side project and it's on early stage development (it doesn't have detailed documentation yet), so your patience and constructive criticism are much appreciated.
Thank you in advance!
P.S. Please suggest other subreddits that you believe could help me by crossposting this
https://preview.redd.it/iuqo0anh92q...bp&s=100ff20c397d0f545c6948ce583febed1cf16535
I've been investing time into a side project named BREACH :: HARBOR. It's a self-hosted cybersecurity platform crafted to not just fend off threats but to anticipate them. Here's a breakdown:
- Collector: (Python) It gathers threat data (in simple words a honeypot).
- Core API: (Python/Django and React) Acts as the central hub where data is processed and visualized.
- Defender: This is still in the early stages, and I haven't released the repository yet. Its role is to use insights to enforce security policies, starting from iptables/nftables.
Currently, its primary functionality revolves around collecting attack data and visualizing it. I'm actively working on adding a notification system next to the Core API.
Finally it should be able to proactively block specific hosts which have a bad score in real time (e.g. a subnet from country X attacking the local network or a remote host in the infrastructure). The Defender should be able to automatically manage blocking rules on the machines it's installed. I have already gathered attack data for hundreds of thousands of attacks, the Collector is on the wild internet for 2 months now.
I genuinely appreciate feedback on the overall concept, workflow, and any essential features you believe should be integrated. I'm also planning to expand its functionalities and, in the future, offer a global threat data service (CloudSync) as a way to monetize. Or hunt any funding to let me invest more time on it and push it a little bit to become more popular as a platform.
Your insights and suggestions will be invaluable! Keep in mind this is a solo side project and it's on early stage development (it doesn't have detailed documentation yet), so your patience and constructive criticism are much appreciated.
Thank you in advance!
P.S. Please suggest other subreddits that you believe could help me by crossposting this
https://preview.redd.it/iuqo0anh92q...bp&s=100ff20c397d0f545c6948ce583febed1cf16535