SOC · Blue Team
Automated SOC Deployment & Detection Coverage
Designed and automatically deployed an open-source SOC architecture with Wazuh, OpenSearch, Sysmon and Auditd, orchestrated via Ansible. Centralised log ingestion, real-time threat correlation and detection coverage evaluation via MITRE ATT&CK Navigator. Metrics: MTTD, false-positive rate, coverage ratio.
Wazuh
OpenSearch
Ansible
Sysmon
MITRE ATT&CK
Auditd
SIEM · EDR · Honeypot
SIEM/EDR, Keylogger & Honeypot Infrastructure
Full SOC lab under VirtualBox: pfSense firewall, Suricata IDS, Wazuh SIEM/EDR/FIM, Syslog-ng transport and automated Active Response. Real-time SYN Flood detection and blocking with custom decoders (filterlog, EVE JSON) and MITRE ATT&CK correlation.
pfSense
Suricata
Wazuh
Syslog-ng
VirtualBox
GRC · Risk Analysis
Risk Analysis — ISO 27005 / EBIOS RM
Complete threat modelling on a vaccine laboratory scenario: attacker profiling, attack path mapping, MITRE ATT&CK alignment, risk scoring and treatment plan generation following ISO 27005 and EBIOS RM methodologies.
ISO 27005
EBIOS RM
MITRE ATT&CK
STRIDE
Malware Analysis
Static & Dynamic Malware Analysis — brbbot.exe
Full malware analysis lab on brbbot.exe in an isolated VirtualBox environment. Static analysis via PEStudio (imports, entropy, hashes), dynamic analysis via Procmon and Regshot (+227,852 registry keys delta). IoC identification and C2 behaviour classification.
PEStudio
Procmon
Regshot
Sysmon
VirtualBox
Virtualisation · Storage
iSCSI Configuration — ESXi & TrueNAS
Lab deployment of an iSCSI SAN between VMware ESXi (Type-1 hypervisor) and TrueNAS in a VMware Workstation environment. Storage target configuration, initiator mapping and datastore provisioning.
VMware ESXi
TrueNAS
iSCSI
VMware Workstation
Web · Dev
Task Management Web Application
Full-stack task management platform developed with HTML, CSS, PHP and XAMPP with MySQL database integration for CRUD operations, user sessions and task tracking.
PHP
HTML/CSS
MySQL
XAMPP