PROJECT / 01DETECTION & RESPONSE
Automated SOC Pipeline
From endpoint telemetry to an investigation case. Wazuh, Shuffle, and TheHive connected in one response workflow.
WazuhShuffleTheHive
View projectTHE WORK
Projects.
Practical investigations, response workflows, and tools. Each project includes the process behind the result.
PROJECT EVIDENCE
Results, at a glance.
SOC Pipeline01
~3.1 slab workflow
Automated enrichment, TheHive alert creation, and analyst notification.
IOC Analyzer02
Batch triageenriched IOCs → reports
Classifies indicators, correlates threat intelligence, and exports JSON / CSV.
Wireshark Investigations03
7 casespacket-level investigations
Recovered HTTP objects, identified scan patterns, and examined authentication and TLS.
Azure SOC Honeypot04
100K+security events / 24 hours
Collected attack telemetry and mapped source locations in Microsoft Sentinel.
PROJECT / 01
PROJECT / 02PYTHON / THREAT INTELLIGENCE
IOC Threat Intelligence Analyzer
A Python tool for batch indicator enrichment, VirusTotal and OTX lookups, and risk summaries that support triage.
PythonVirusTotalAlienVault OTX
View project
PROJECT / 03PACKET INVESTIGATION
Network Traffic Analysis
Seven Wireshark investigations covering HTTP recovery, reconnaissance, SMB authentication, Kerberos, and TLS.
WiresharkPCAPProtocols
View project
PROJECT / 04CLOUD / SECURITY MONITORING
Azure SOC Honeypot
Attack telemetry from a Windows VM, investigated with Microsoft Sentinel, KQL, and a geolocation dashboard.
AzureSentinelKQL
View project
Interested in how I worked through the evidence?
Explore the field notes