Investigation Cases
Why: The closest thing to the real L1 analyst job, and the highest signal per hour.
Full blue-team CTF investigations published as reports: timeline, IOCs, ATT&CK mapping, remediation.
CRITICALIN PROGRESS
← krovix@sec:~$ cd /homeIndex01 02Planned — coming soon 03Planned — coming soon 04Planned — coming soon 05 06Planned — coming soon 07 08Planned — coming soon 09Planned — coming soon 10 11Planned — coming soon 12Planned — coming soon 13Planned — coming soon 14Planned — coming soon 15Planned — coming soon 16Planned — coming soon 17Planned — coming soon 18Planned — coming soon 19Planned — coming soon 20Planned — coming soon 21Planned — coming soon 22Planned — coming soon
All projects — the full case index. (22)
Every case, listed and readable. The orbit on the homepage is the show — this is the record.
// Detection & SIEM (6)
Enterprise SOC Lab
Why: Experience on paper before the first job.
Build an AD network, attack it with Atomic Red Team, detect in Splunk, then investigate and report.
CRITICALPLANNED
AI SOC Assistant
Why: The interview centrepiece: AI where the SOC actually hurts.
An AI analyst that triages alerts, maps ATT&CK, drafts incident reports, and suggests remediation.
CRITICALPLANNED
Purple-Team Loop
Why: The red-team bridge employers love.
Run an atomic test, check if the SIEM alerts, write a detection if it misses, then tune it.
HIGHPLANNED
Detection Eng
Why: The core detection-engineering workflow, end to end.
Data source to detection logic to validation with Atomic Red Team to deploy and monitor.
HIGHIN PROGRESS
Azure Sentinel SOC
Why: Cloud-SOC skill and SC-200 revision in one.
Ingest telemetry into Microsoft Sentinel and write custom KQL analytics rules.
HIGHPLANNED
// Endpoint (3)
Wazuh Home Lab
Why: The always-on detection playground.
Ship Sysmon endpoint telemetry into Wazuh with custom rules and ATT&CK mapping.
HIGHIN PROGRESS
File Integrity Mon
Why: A core defensive control every endpoint needs.
Watch critical files, hash them, and alert the moment one changes unexpectedly.
MEDIUMPLANNED
Keylogger Detector
Why: Learn endpoint defence by hunting the threat directly.
Inspect processes and OS hooks to surface behaviour consistent with keylogging.
MEDIUMPLANNED
// Incident Response & Intel (4)
IR Case Study
Why: A scripted end-to-end IR engagement, written up properly.
Work a ransomware PCAP through the full NIST IR lifecycle as a PDF report.
MEDIUMIN PROGRESS
Phishing Analysis
Why: A literal daily L1 task and a quick win.
Analyse 10-15 real phishing samples: headers, SPF/DKIM, detonation, IOCs, verdict.
MEDIUMPLANNED
CTI Report
Why: Shows the writing and communication managers prize.
Profile a threat actor, map TTPs in ATT&CK Navigator, write a BLUF intel report.
MEDIUMPLANNED
Honeypot 7 Days
Why: Real attackers, real data.
Deploy an internet-facing honeypot on a VPS, log 7 days of activity, document IOCs and TTPs.
MEDIUMPLANNED
// Network (4)
Port Scanner
Why: The foundational recon tool, built not just used.
Scan hosts for open ports and grab service banners the way Nmap does under the hood.
MEDIUMPLANNED
Packet Sniffer
Why: See the wire the way Wireshark does.
Capture and dissect live network packets, printing protocol and header detail.
MEDIUMPLANNED
Intrusion Detection
Why: Understand detection by writing one from scratch.
A Python IDS that inspects live traffic against signature rules and logs alerts.
HIGHPLANNED
Firewall Simulator
Why: Understand rule ordering and packet filtering by building the engine.
Apply a configurable ruleset to simulated traffic and show what gets allowed or dropped.
MEDIUMPLANNED
// Web Security (5)
OWASP Lab
Why: The red-team angle: build it broken, break it, fix it.
Build an app with intentional vulns, exploit every OWASP Top 10 class, then patch and verify.
MEDIUMPLANNED
Web Vuln Scanner
Why: The offensive complement to the OWASP lab.
Crawl a target site and probe for common SQLi and XSS injection points.
LOWPLANNED
Phishing Page Det
Why: Stops the attack most breaches start with.
Score URLs on lexical and WHOIS features with a classifier to flag phishing pages.
HIGHPLANNED
Password Cracker
Why: Understand why weak hashes fall, so you can defend them.
Run dictionary and brute-force attacks against common hash types.
LOWPLANNED
Encrypted Chat
Why: Applied cryptography you can message on.
A chat app with RSA key exchange and AES message encryption over WebSockets.
LOWPLANNED