Security Operations Centre Update
Trust Lab Security Operations Center is a free, open-source Security Information and Event Management (SIEM) platform built and maintained at IIT Bombay’s Trust Lab. It was designed from the ground up to give universities, colleges, and resource-constrained organisations the ability to monitor their own IT infrastructure for security threats — without paying for expensive commercial tools.
The project started with a clear problem: universities and academic institutions generate large amounts of security-relevant log data from email servers, web servers, firewalls, and identity management systems, but they lack the budget for enterprise SIEM products and the staff to manage complex commercial deployments.
Existing open-source tools like Wazuh were evaluated but had key shortcomings for this use-case:
Key Design Principles
To build an accessible security monitoring engine, IITB TL SOC set out to eliminate the friction that historically keeps resource-constrained organizations from achieving a robust digital posture.
Traditional security platforms demand heavy investments and complex software knowledge. By reimagining our architecture from the ground up, IITB TL SOC prioritized scomplete operational transparency and flexibility, thus ensuring that any institution can deploy, scale, and tailor its cyber defenses within minutes without financial or technical barriers.
Trust Lab SOC Pipeline
Trust Lab SOC follows a pipeline architecture where logs flow through a series of processing stages before being stored, matched against security rules, and visualized. The architecture has been designed to be decoupled — each stage is independent and can be scaled or replaced without affecting the others.
What Can Trust Lab SOC Detect?
Web Application Security: Detects web-targeted threats including brute-force login attempts, exposed application directories, sudden traffic surges, potential DoS/DDoS attacks, and web app identity exploitation targeting tools like Roundcube.
Email Security: Flags mail-based anomalies and vector attacks, such as emails received from or sent to malicious domains, as well as single-source and distributed mail bombing attempts.
Host & Endpoint Security: Monitors host integrity and access patterns to identify successful SSH brute-force attacks, unauthorized privilege escalation, and unauthorized system file changes via File Integrity Monitoring (FIM).
Firewall & Network Security: Identifies network-level probing and perimeter threats, including port/network scanning, invalid TCP host access, traffic involving known malicious IPs, and unauthorized connections originating from outside approved IP ranges
Current Deployment Status & Findings
Trust Lab SOC is actively monitoring production infrastructure at IIT Bombay. 
The following screenshots show Trust Lab SOC running in production at IIT Bombay, capturing live dashboards, real security alerts, and actual vulnerability findings from the Moodle infrastructure assessment.
Agentic SOC
Digital defense cannot be exclusively for multi-billion-rupee enterprises with unlimited IT budgets. Securing the digital ecosystem requires equipping every link with defensive tools. And as strict regulatory frameworks like the DPDP Act come into full effect and cyber breaches carry financial penalties, small and medium enterprises can no longer afford to leave their networks unmonitored.
Trust Lab SOC bridges the gap between stringent compliance mandates and tight operational budgets. The platform offers small organizations a pathway to defend their data and comply with regulatory requirements.
Trust Lab is also developing an Agentic SOC — this next-generation platform integrates autonomous AI agents to handle real-time threat investigation and automate alert triage —which will further reduce manual workload for small institutions in their fight against cyber threats.
