The customer was the desk next to mine
Aerial Eye is used primarily by the student SOC at Tennessee Tech. I started it while it was still an open question whether the team would have a SIEM at all. Under that uncertainty I did not wait for procurement to land. I took initiative and built a working system.
They were the primary customer. I built and open-sourced it on my own time, after work, with their workflow in mind — not as a portfolio piece that happened to mention security. The desk now runs Aerial Eye and one other SIEM. That is the outcome I wanted: they were not stuck if the purchase went either way.
The system
Log ingestion sits on ClickHouse, an OLAP database that can take mass logs without folding. That choice is the product. A SOC dashboard that cannot drink the firehose is a toy.
v1.0 added capabilities most open-source setups still skip:
- A heatmap of where activity is coming from
- A downtime-cost analysis calculator, so a blocked event has a business number attached to it
- Notes on alerts, so an analyst can leave a trail for the next shift
- Local AI for database queries and for explaining a threat signature — the model stays on-box, so packet data does not leave the SOC to get a sentence of English
- Network traffic
- IDS (Suricata)
- ClickHouse
- Dashboard + local AI
I later deployed it for the same analysts and wrote for the Cyber Sentinel, the SOC’s monthly newsletter on cyber crime. Building the tool and standing next to the people who use it were the same job.
What shipped
A SIEM a student team can stand up, shipped before anyone knew if a commercial one was coming. Source is public. If you want to read the code, start at the repo.
github.com/sqmorrison/aerial-eye
- ClickHouse
- Next.js
- Suricata
- Local AI
- Docker