soc-analysis

🛡️ Modular Python framework for Cybersecurity LLM agents, purple team automation, log triage, and detection engineering in lab environments.

A command-line tool for analysing Suricata EVE JSON alert logs and converts them to .txt readable output for SIEM analysis. Built with Python, 2026.

Open-source, on-premise, AI-powered SOC alert triage tool.

ANDS (Anomaly-based Network Detection System) is a modular, high-performance network security telemetry and threat-hunting framework built for SOC Analysts, Network Auditors, and Incident Responders.

"A comprehensive network security lab featuring FortiGate NGFW configuration, firewall policy management, and real-time traffic monitoring and analysis."

Windows security investigation analyzing failed authentication attempts using Event Viewer and Event ID 4625.

This project required the built-in of high-confidence detections in Microsoft Sentinel using KQL, focusing on identity security and reducing false positives. This project targets MFA bypass and correlates signals like impossible travel and abnormal access patterns to detect real-world attacks.

Interactive SOC L1 Investigation Lab with 500+ simulated security alerts, SIEM-style triage, process analysis, threat intelligence, incident escalation and persistent investigation history.

IT Support and SOC portfolio project with practice scenarios, questions, and a React based SOC and IT simulator

Investigated suspicious Microsoft 365 sign in activity using portal triage, containment actions like session revocation and stronger authentication, then validated remediation and practiced structured KQL hunting patterns with Azure Monitor Logs demo data.

A Microsoft Sentinel SOC homelab in Azure, where I built and validated a basic cloud SOC workflow: data onboarding, detection, investigation, and visualization. It demonstrates practical blue-team skills in SIEM operations, KQL-based threat hunting, watchlist enrichment, and workbook reporting.

Forensic network baseline analysis & packet extractions of DNS protocol traffic using TShark & Wireshark.

Practicing to find true positive alerts and commenting the process

Professional phishing email analysis report and employee security awareness framework for corporate risk mitigation.

SOC-style phishing incident investigation analyzing a multi-vector job scam campaign. Performed email header analysis, URL inspection, and IOC extraction; mapped attack techniques to MITRE ATT&CK and documented findings with remediation and responsible disclosure.

Network traffic investigation using Wireshark to analyze HTTP traffic and identify network communication patterns.

Laboratorio de telemetría y visibilidad de red centralizada utilizando Syslog, AAA Accounting (TACACS+) y NetFlow en Cisco Packet Tracer.

Cybersecurity Engineering student passionate about technology, security, and continuous learning. Building practical projects, exploring emerging technologies, and developing skills to solve real-world challenges.

Artefact conçu pour déplacer la surface d'action vers la représentation opérationnelle d'un système défensif. Pas d'exploitation, pas de persistance. L'espace cognitif comme terrain. Ce qui cesse d'être observé pendant la qualification est l'espace dans lequel il opère.

Análisis forense de tráfico de red y auditoría de ciberseguridad con Wireshark. Incluye reconstrucción de paquetes, filtros de inspección profunda (DPI), detección de ataques MITM (ARP Spoofing), escaneo de puertos y extracción de artefactos.