Selected work · 03

Aerial Eye

When I started, the student SOC at Tennessee Tech did not know whether they would have a SIEM. I did not wait to see how the cards fell. I treated them as the customer, built Aerial Eye after hours, and open-sourced it. They now run it alongside another SIEM.

The customer was the desk next to mine

Aerial Eye is used primarily by the student SOC at Tennessee Tech. I started it while it was still an open question whether the team would have a SIEM at all. Under that uncertainty I did not wait for procurement to land. I took initiative and built a working system.

They were the primary customer. I built and open-sourced it on my own time, after work, with their workflow in mind — not as a portfolio piece that happened to mention security. The desk now runs Aerial Eye and one other SIEM. That is the outcome I wanted: they were not stuck if the purchase went either way.

The system

Log ingestion sits on ClickHouse, an OLAP database that can take mass logs without folding. That choice is the product. A SOC dashboard that cannot drink the firehose is a toy.

v1.0 added capabilities most open-source setups still skip:

  1. Network traffic
  2. IDS (Suricata)
  3. ClickHouse
  4. Dashboard + local AI

I later deployed it for the same analysts and wrote for the Cyber Sentinel, the SOC’s monthly newsletter on cyber crime. Building the tool and standing next to the people who use it were the same job.

What shipped

A SIEM a student team can stand up, shipped before anyone knew if a commercial one was coming. Source is public. If you want to read the code, start at the repo.

github.com/sqmorrison/aerial-eye