sankettaware16/foss-soc-engine ? reverse-engineered prompt

Build me a Python service for a security team that reads raw logs from Kafka, figures out what kind of log each message is, and turns it into clean structured JSON in Elastic Common Schema format.

I want the parsing to be driven by YAML rules instead of hardcoded parsers, so adding a new log source is mostly just writing a rule and mapping it in config. It should handle simple regex logs, multi line logs that need to be stitched back together, and logs that are already JSON or XML. Please also add timestamp normalization, GeoIP style enrichment for source and destination addresses, and a way to tag internal IP ranges with friendly names from a local YAML file. Make it reliable, with dead letter handling, safe offset commits, and a preflight check that validates config and rules before starting. If it makes sense, include a small web UI for editing rules and watching the engine run. Use the current docs online if you need to check any details.