HONEYPOT BASED Security Operations Center (SOC) is developed to address the rising security threats faced by modern web applications, particularly brute force attacks that attempt to gain unauthorized access through repeated login attempts. Detecting such attacks at an early stage is essential to prevent data breaches, service disruption, and unauthorized system access.

The system deploys a honeypot website using Apache2 on Ubuntu Linux to simulate a realistic web environment that attracts malicious login activity. Multiple login attempts are generated through the Ubuntu Terminal to produce detailed log data capturing attacker behavior. These logs are forwarded to Splunk, which functions as the Security Operations Center (SOC) platform for collecting, indexing, and analyzing security events. Splunk enables the identification of attack patterns, tracking of source IP addresses, and generation of alerts when suspicious behavior exceeds predefined thresholds.