A Hybrid SIEM/SOAR Platform for Integrated Physical and Cyber Security Monitoring in Logistics Environments with Offensive Vulnerability Assessment

The digital transformation of logistics operations through Industrial Internet of Things (IIoT) technologies has introduced unprecedented complexity in security monitoring. Traditional approaches treat physical security, cybersecurity, and equipment maintenance as separate domains, creating silos that hinder comprehensive threat detection and response. This paper presents the design, implementation, and experimental evaluation of HybLogSec, a hybrid Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) platform specifically designed for logistics environments. The proposed system integrates real-time telemetry monitoring from 310 heterogeneous devices (cameras, drones, robots, environmental sensors, and PLCs) with automated offensive security scanning using containerized tools (nmap, nuclei). The platform simultaneously addresses: (1) cybersecurity threats through anomaly detection and vulnerability assessment, (2) physical security monitoring including tampering detection and environmental anomalies, and (3) predictive maintenance through equipment telemetry analysis. Experimental evaluation demonstrates linear scalability up to 62 agents (throughput 11.88 msg/sec) with gradual resource saturation beyond 100 agents. The system achieves 100% attack detection rate with zero false positives across three attack scenarios (Port Scanning, Brute Force, Telemetry Flood), with mean detection time of 11.6 seconds and ROC AUC of 0.98. Statistical analysis (ANOVA) confirms significant workload impact on performance (p < 0.001). The platform successfully bridges the gap between theoretical performance modeling (M/M/1 queueing theory, R2 = 0.97) and practical industrial security implementation, providing a unified framework for logistics security operations.