A prototype GreyNoise integration for FluentBit with Lua scripts.

Notif360 is an open-source system monitoring and notification tool designed to provide comprehensive oversight of critical system metrics, website health, and malware scanning

This repository stores tables for use in SEIM tools (specifically Sumologic)

Network Access Control (NAC) + Security Information and Event Management (SIEM) + Continuous Threat Exposure Management (CTEM)

Security Event and Incident Management: A security software that helps recognize and address potential security threats and vulnerabilities.

Splunk SIEM investigation lab with SPL detection rules, BOTS dataset analysis, and IR reports mapped to MITRE ATT&CK

First attempt at a lambda architecture SEIM using Power BI & Azure Sentinel

Enterprise-style Wazuh SIEM homelab featuring Windows & Linux monitoring, Sysmon, Auditd, custom detections, threat hunting, incident response, and MITRE ATT&CK mapping.

My SOC Level 1 study notes from TryHackMe. Covers threat intelligence, SIEM investigations, digital forensics, endpoint monitoring, and phishing analysis, with practical labs using tools like Splunk, Wireshark, Sysmon, and Volatility.

Enterprise-style offensive security range: segmented pfSense architecture, intentionally vulnerable AD forest, detection engineering. Ongoing build.

CTI Lab 2 — Malicious File Analysis, ELK Stack, Purple Teaming (MITRE ATT&CK), and Elastic SIEM Alerting exercises. Tools: Sysmon, Atomic Red Team, Kibana, VirusTotal.

Basic Intrusion Detection System using Scapy

A self built log monitoring and alerting tool. Parses SSH auth logs with Bash and Python to detect brute force attacks and privilege escalation, renders the findings in a custom JavaScript dashboard, and ships with Splunk SPL queries for SIEM style correlation.

seim + idr without an api

Mini-SIEM is a lightweight, dark-themed security monitoring dashboard that simulates attacks, tracks incidents by severity, and helps you practice real-world SOC skills in Python.

Portfolio of activities from the Google Cybersecurity Professional Certificate

Simulated suspicious process activity in Splunk and visualized it on a KPI dashboard. Sentinel alert for failed sign-ins, end-to-end SIEM detection, KQL queries, and automated alerting.

A hands-on Wazuh SIEM home lab for centralized log collection, endpoint monitoring, threat detection, and security event analysis.