Projects

5 projects

• SOC automation lab

  Explored

  A home lab wiring Sysmon telemetry into Wazuh, with Shuffle enriching alerts through VirusTotal and opening cases in TheHive.

  Wazuh, Sysmon, Shuffle, TheHive, VirusTotal API SIEMSOARincident responsethreat intelligence

• SOC alert triage dashboard

  Simulated

  An in-browser alert queue with filtering, MITRE ATT&CK mapping and a triage panel that explains each disposition. Runs on synthetic alerts.

  TypeScript, Astro, Vitest SIEMalert triagedetection

• Guided log investigations

  Planned

  Step-through scenarios where the reader flags suspicious log lines and checks their reasoning against analyst notes and a Sigma-style rule.

  TypeScript, Sigma log analysisdetectionincident response

• IOC extractor and defanger

  Planned

  Paste a report or email and get the IP addresses, domains, URLs and file hashes pulled out, validated and defanged for safe sharing.

  TypeScript threat intelligenceIOCdefensive tooling

• Python alert-enrichment script

  Planned

  A command-line script that reads exported alerts, looks up file hashes, and writes a short triage summary for each one.

  Python, VirusTotal API Pythonautomationthreat intelligence