Project Phoenix
- Role
- Solo — pipeline, rules, API, frontend
- Period
- Apr — Sep 2026
- Stack
- TypeScript, Node, Express, OpenAPI, Render
The problem
Security log analysis tools increasingly answer with a language model, which means the same input can produce different findings on different days. For forensics, an answer you cannot reproduce is not evidence.
What I did
Built a log forensics engine that is deterministic by design and uses no model at all. A five-stage pipeline ingests real nginx, Linux auth and JSON logs, decodes obfuscated payloads before matching, runs the rule set, correlates events by attacker, and generates the report.
What happened
28 detection rules across five attack categories, 144 tests passing, and a live frontend, backend and Swagger reference deployed. Because it is regex rather than inference, the same log file produces the same report every time.
Deobfuscation has to come before detection
The stage order is the whole design. A rule set that matches on raw request strings misses anything URL-encoded, Base64-wrapped or Unicode-escaped — which is to say it misses anything deliberate.
Correlation is what turns alerts into an incident
Individual alerts are noise. Grouping events by IP and building attack chains through a sliding window is what surfaces a multi-stage attack as one story rather than forty unrelated lines.