Unified Cyber Investigation Platform with IoT-Based SOC Monitoring and Digital Footprint Analysis

Security Operations Centers (SOCs) form the back- bone of modern enterprise cyber defense, continuously monitoring authentication activity, system behavior, and threat intelligence. Credential-based attacks such as brute-force login attempts, password spraying, and unauthorized access remain among the most effective and persistent intrusion techniques. While commercial SIEM platforms provide advanced analytics and correlation, they often suffer from delayed alerting, alert fatigue, and limited analyst attention. Furthermore, most SOC solutions lack tangible physical alerting mechanisms that can im- mediately draw human attention during active attack scenarios. This paper presents a Unified Cyber Investigation Platform that integrates Windows authentication monitoring, real-time SOC visualization, IoT-based physical alerting, and digital foot- print analysis. Windows Security Event Logs are forwarded using NXLog to a Raspberry Pi-based monitoring node, where authentication events are analyzed using threshold-based, temporal, and behavior-aware detection models. Upon detection of suspicious activity, the platform triggers real-time dashboard alerts and GPIO-controlled physical buzzer notifications. Extensive architectural analysis, threat modeling, SOC workflow mapping, performance evaluation, and governance alignment demonstrate that the proposed platform improves situational awareness, reduces detection latency, and enhances response readiness. The platform is designed to be cost-effective, interpretable, and suitable for educational institutions, research laboratories, and small-to-medium enterprise environments. In addition, the system emphasizes explainable detection logic, allowing analysts to understand alert causes rather than relying on opaque black-box mechanisms. This feature is particularly valuable in academic environments and training-focused SOC simulations.