Creya Aegis
Enterprise SOC Automation Platform
Project Overview
Creya Aegis is a cloud-native, cost-effective Security Operations Center (SOC) automation platform designed primarily for Small and Medium-sized Enterprises (SMEs). The platform combines essential capabilities of a SIEM (Security Information and Event Management) and SOAR (Security Orchestration, Automation and Response) system into a single automated security pipeline.
Many SMEs are frequent targets of cyberattacks but cannot afford expensive enterprise security platforms or maintain a dedicated SOC team. Traditional SIEM solutions can be costly, complex, and resource-intensive. Creya Aegis addresses this problem by providing an affordable, modular, and cloud-native platform capable of collecting security logs, detecting suspicious activity, enriching events with threat intelligence, calculating risk, correlating attacks, and automatically initiating appropriate responses.
The platform uses intelligent filtering, caching, parallel processing, smart routing, and AWS serverless services to achieve efficient threat detection and response while minimizing operational and API costs.
Problem Statement
Organizations generate large volumes of security logs from Linux systems, web servers, firewalls, cloud infrastructure, and other security tools. Manually monitoring these logs is difficult, time-consuming, and often requires skilled cybersecurity professionals.
SMEs particularly face several challenges:
- Limited cybersecurity budgets.
- Lack of dedicated SOC teams.
- Difficulty managing large volumes of logs.
- Delayed detection and response to attacks.
- High licensing and infrastructure costs of enterprise SIEM platforms.
Creya Aegis aims to provide an affordable solution that automates the complete security monitoring and incident-response workflow.
System Architecture
Creya Aegis follows a modular security pipeline:
The platform collects logs from multiple sources, including:
- Linux system logs.
- Apache access and error logs.
- Nginx logs.
- Firewall and iptables logs.
- AWS CloudTrail logs.
Raw logs are converted into structured events by dedicated parsers. The first Decision Engine (DE1) performs prefiltering using keywords, regular expressions, and source-specific rules to identify potentially suspicious events.
The system then extracts Indicators of Compromise (IOCs) such as IP addresses, domains, URLs, email addresses, and file hashes.
Threat Intelligence
A major component of Creya Aegis is its multi-layered Threat Intelligence system.
The ThreatIntelManager coordinates multiple intelligence providers, including:
- VirusTotal for IP, domain, URL, and file-hash reputation.
- AbuseIPDB for malicious IP and abuse-confidence information.
- AlienVault OTX for threat intelligence, attack campaigns, malware information, and security pulses.
- Local IOC Intelligence for organization-specific malicious indicators.
- Local Behaviour Intelligence for detecting suspicious patterns across multiple branches or systems.
External providers are queried in parallel to reduce latency. The platform also uses multiple optimization techniques such as timeouts, circuit breakers, and bounded concurrency to prevent slow or failing providers from affecting the complete pipeline.
Intelligent Caching
Creya Aegis uses two levels of caching:
- L1 Memory Cache: Provides extremely fast retrieval of recently queried threat intelligence.
- L2 SQLite Cache: Stores intelligence results persistently and prevents repeated API calls even after application restarts.
This significantly reduces API usage, improves performance, and helps keep the platform affordable.
The system also uses smart domain filtering to prevent unnecessary external API requests for internal software names, Linux services, namespaces, and invalid domains.
Smart Routing and Detection Pipeline
After threat intelligence results are combined by the Fusion Engine, the second Decision Engine (DE2) classifies events as:
KNOWN_ATTACKKNOWN_BENIGNUNKNOWN
One of the key innovations of Creya Aegis is Smart Routing.
Events confidently identified as benign can skip computationally expensive downstream processing and are directly stored. Suspicious or unknown events continue through advanced analysis stages.
The downstream pipeline performs:
- Event normalization.
- Session grouping.
- Noise and duplicate alert reduction.
- Behaviour analytics.
- Multi-source event correlation.
- Rule-based threat detection.
- Dynamic risk scoring.
- Final severity classification.
This approach reduces unnecessary processing and allows computing resources to focus on potentially dangerous events.
Attack Detection Coverage
Creya Aegis is designed to detect common cybersecurity threats affecting SMEs.
| Attack Type | Detection Method |
|---|---|
| Brute Force | Repeated failed login attempts from users or IP addresses. |
| Credential Stuffing | Multiple authentication attempts involving similar credentials across different IPs. |
| SQL Injection | Detection of suspicious SQL patterns and malicious request parameters. |
| Cross-Site Scripting (XSS) | Detection of suspicious script payloads in web requests. |
| DDoS | Identification of abnormally high request or connection rates. |
| Cryptojacking | Detection of mining-related processes and suspicious domains. |
| Port Scanning | Identification of multiple destination ports targeted by a single source. |
The Local Behaviour Intelligence module can also detect distributed attacks, where suspicious activity occurs across multiple branches but does not individually cross the detection threshold at each location.
AWS Integration and SOAR
Creya Aegis integrates AWS serverless services for scalable storage, alerting, and automated incident response.
Amazon S3
Security events, incident summaries, automated response logs, and weekly reports are stored in Amazon S3.
Amazon SNS
SNS is used to send alerts to the SOC team:
- Email alerts for medium and higher severity incidents.
- SMS alerts for high and critical incidents.
- SOAR notifications to trigger automated response workflows.
AWS Lambda
For high-severity incidents, SNS can trigger a SOAR Lambda function. Depending on the configured playbook, the response can include:
- Blocking a malicious IP.
- Updating security controls.
- Simulating host isolation.
- Recording the response action for auditing.
This enables Creya Aegis to move beyond detection and provide automated security response.
Dashboard and Reporting
The platform includes a Streamlit-based dashboard that provides visibility into the security environment.
The dashboard displays:
- Total security events.
- Severity distribution.
- Recent high-priority alerts.
- Attack statistics.
- Top source IP addresses.
- Event classifications.
- Automated actions performed by AWS services.
The system also supports automated weekly security reports. These reports summarize major incidents, attack trends, risk information, and actions taken by the SOAR system. Reports are stored in Amazon S3 and can be delivered to the SOC team.
Performance and Cost Efficiency
Creya Aegis is designed with affordability and efficiency as major priorities.
Key optimizations include:
- Parallel threat intelligence queries.
- Multi-level caching.
- Smart routing of benign events.
- Circuit breakers for unavailable providers.
- Provider-level timeouts.
- Failure caching.
- Intelligent IOC and domain filtering.
- Bounded concurrency.
By reducing unnecessary API calls and processing, the platform can operate with very low infrastructure costs. AWS serverless services further reduce the need for maintaining dedicated servers.
Future Enhancements
Future development of Creya Aegis may include:
- Machine-learning-based anomaly detection.
- Automatic MITRE ATT&CK mapping.
- Integration with Microsoft 365 and Google Workspace.
- Kubernetes and container security monitoring.
- Customizable SOAR playbooks.
- Compliance report generation.
- Multi-tenant support for MSSPs.
- Advanced cloud cost monitoring and budget controls.
Conclusion
Creya Aegis demonstrates that advanced SOC automation can be made accessible to SMEs without requiring expensive enterprise security infrastructure.
By combining multi-source log collection, global and local threat intelligence, intelligent filtering, smart routing, behavioural analytics, event correlation, dynamic risk scoring, AWS-based alerting, and automated SOAR actions, the platform provides an integrated approach to cybersecurity monitoring and response.
The project focuses on a simple but powerful idea:
Security should be accessible, intelligent, automated, and affordable.