This is my capstone project for Unitec, built in partnership with Netbridge. The idea is simple: instead of logging into three different vendor portals to check what is happening on the network, everything feeds into one dashboard that uses a local AI model to explain what it all means in plain English.
What it actually is
PlainSight is three things working together. A Wazuh SIEM backend sitting on Ubuntu via VMware ESXi that ingests syslog from the FortiGate 60E, the Ruckus R650 WAP, and the FS-148F switch. A Streamlit dashboard that talks to Wazuh via its REST API and surfaces everything in one view. And a local phi3:mini model running through Ollama that reads the alerts and writes a plain English summary with MITRE ATT&CK tags attached.
No data goes to the cloud. No API keys. No licensing fees. The whole thing runs on a ThinkCentre with an i5-8500T and 16GB of RAM sitting in the Netbridge lab.
Getting Wazuh running
The all-in-one installer is genuinely straightforward. You run one script and it handles Elasticsearch and Logstash for you. What tripped me up was the Logstash pipeline dropping packets as soon as all three devices started forwarding at once. Took me a while to figure out it was a buffer size issue. Bumped queue.max_bytes from 1GB to 4GB and it stopped dropping.
Getting syslog forwarding working on the FortiGate was fine. The Ruckus took a bit more digging through the web UI to find the right setting. The switch was the easiest of the three.
Where things are at
Events are indexing in under 2 seconds from receipt. The dashboard is pulling live from the Wazuh API. The AI summary side still needs work but the core pipeline is solid.
Next session I want to get the PDF export working and tighten up the MITRE tagging logic.