All projects — the full case index. (24)

Built work first, then what's in progress, then the roadmap. The orbit on the homepage is the show — this is the record.

// Built & shipped (3)

DetectionForge

Why: Detection engineering is the core SOC skill - so I built the pipeline that does it, end to end, and had a working detection engineer review it.

An AI-assisted pipeline that turns unstructured threat intelligence into vendor-agnostic Sigma, SPL, and KQL detection rules. A MITRE ATT&CK retrieval layer grounds each rule, and a self-correcting pySigma validation loop catches and repairs malformed rules automatically - scoring ~0.750 on a custom evaluation harness. Reviewed by a practising Splunk detection engineer and submitted to Kaggle's 5-Day AI Agents hackathon.

#Sigma#SPL#KQL#MITRE ATT&CK#Gemini#pySigma

CRITICALBUILT

Open case →

AI Safety Risk Classifier

Why: Interpretable ML for AI-safety risk triage - built from scratch to understand the model, not just call an API.

A decision-tree classifier (Gini impurity, recursive best-split, and prediction) implemented from scratch in Python, reaching 83% held-out accuracy against a matched scikit-learn baseline. A failure-analysis pass surfaced a real safety failure mode - every misclassification collapsed to the medium class, under-calling two high-risk cases.

#Python#scikit-learn#NumPy#Decision Trees#ML

HIGHBUILT

Open case →GitHub

NetGuard

Why: Reading the wire the way an analyst does - understanding network traffic and detection logic hands-on, not from a textbook.

A Python + Scapy tool that ingests a PCAP, groups TCP traffic by source/destination, and flags likely port scans with a rule-based score (unique destination ports, SYN ratio, and burst timing) mapped to LOW/MEDIUM/HIGH severity. It explains why each flow was flagged and ships with automated tests for the analyzer and detector.

#Python#Scapy#PCAP#Port-Scan Detection#Networking

MEDIUMBUILT

Open case →GitHub

// In progress (3)

Investigation Cases

Why: The closest thing to the real L1 analyst job, and the highest signal per hour.

Full blue-team CTF investigations published as reports: timeline, IOCs, ATT&CK mapping, remediation.

#Splunk BOTS#CyberDefenders#ATT&CK

CRITICALIN PROGRESS

Wazuh Home Lab

Why: The always-on detection playground.

Ship Sysmon endpoint telemetry into Wazuh with custom rules and ATT&CK mapping.

#Wazuh#Sysmon#VirtualBox

HIGHIN PROGRESS

IR Case Study

Why: A scripted end-to-end IR engagement, written up properly.

Work a ransomware PCAP through the full NIST IR lifecycle as a PDF report.

#NIST IR#Wireshark#Wazuh

MEDIUMIN PROGRESS

// Planned — the roadmap (18)

Grouped by domain. These are next.

Detection & SIEM (4)

07Planned — coming soon

Enterprise SOC Lab

Why: Experience on paper before the first job.

Build an AD network, attack it with Atomic Red Team, detect in Splunk, then investigate and report.

#Splunk#Active Directory#Sysmon#ATT&CK

CRITICALPLANNED

08Planned — coming soon

AI SOC Assistant

Why: The interview centrepiece: AI where the SOC actually hurts.

An AI analyst that triages alerts, maps ATT&CK, drafts incident reports, and suggests remediation.

#Python#LLM#LangChain#Splunk

CRITICALPLANNED

09Planned — coming soon

Purple-Team Loop

Why: The red-team bridge employers love.

Run an atomic test, check if the SIEM alerts, write a detection if it misses, then tune it.

#Atomic Red Team#Sysmon#Splunk

HIGHPLANNED

10Planned — coming soon

Azure Sentinel SOC

Why: Cloud-SOC skill and SC-200 revision in one.

Ingest telemetry into Microsoft Sentinel and write custom KQL analytics rules.

#Azure#Sentinel#KQL

HIGHPLANNED

Endpoint (2)

11Planned — coming soon

File Integrity Mon

Why: A core defensive control every endpoint needs.

Watch critical files, hash them, and alert the moment one changes unexpectedly.

#Python#hashlib#watchdog

MEDIUMPLANNED

12Planned — coming soon

Keylogger Detector

Why: Learn endpoint defence by hunting the threat directly.

Inspect processes and OS hooks to surface behaviour consistent with keylogging.

#Python#psutil

MEDIUMPLANNED

Incident Response & Intel (3)

13Planned — coming soon

Phishing Analysis

Why: A literal daily L1 task and a quick win.

Analyse 10-15 real phishing samples: headers, SPF/DKIM, detonation, IOCs, verdict.

#VirusTotal#any.run#CyberChef

MEDIUMPLANNED

14Planned — coming soon

CTI Report

Why: Shows the writing and communication managers prize.

Profile a threat actor, map TTPs in ATT&CK Navigator, write a BLUF intel report.

#ATT&CK Navigator#OpenCTI

MEDIUMPLANNED

15Planned — coming soon

Honeypot 7 Days

Why: Real attackers, real data.

Deploy an internet-facing honeypot on a VPS, log 7 days of activity, document IOCs and TTPs.

#T-Pot#Cowrie#VPS

MEDIUMPLANNED

Network (4)

16Planned — coming soon

Port Scanner

Why: The foundational recon tool, built not just used.

Scan hosts for open ports and grab service banners the way Nmap does under the hood.

#Python#socket#Scapy

MEDIUMPLANNED

17Planned — coming soon

Packet Sniffer

Why: See the wire the way Wireshark does.

Capture and dissect live network packets, printing protocol and header detail.

#Python#Scapy

MEDIUMPLANNED

18Planned — coming soon

Intrusion Detection

Why: Understand detection by writing one from scratch.

A Python IDS that inspects live traffic against signature rules and logs alerts.

#Python#Scapy#SQLite

HIGHPLANNED

19Planned — coming soon

Firewall Simulator

Why: Understand rule ordering and packet filtering by building the engine.

Apply a configurable ruleset to simulated traffic and show what gets allowed or dropped.

#Python#Scapy#Flask

MEDIUMPLANNED

Web Security (5)

20Planned — coming soon

OWASP Lab

Why: The red-team angle: build it broken, break it, fix it.

Build an app with intentional vulns, exploit every OWASP Top 10 class, then patch and verify.

#Flask#OWASP#Git

MEDIUMPLANNED

21Planned — coming soon

Web Vuln Scanner

Why: The offensive complement to the OWASP lab.

Crawl a target site and probe for common SQLi and XSS injection points.

#Python#crawler

LOWPLANNED

22Planned — coming soon

Phishing Page Det

Why: Stops the attack most breaches start with.

Score URLs on lexical and WHOIS features with a classifier to flag phishing pages.

#Python#scikit-learn#whois

HIGHPLANNED

23Planned — coming soon

Password Cracker

Why: Understand why weak hashes fall, so you can defend them.

Run dictionary and brute-force attacks against common hash types.

#Python#hashlib

LOWPLANNED

24Planned — coming soon

Encrypted Chat

Why: Applied cryptography you can message on.

A chat app with RSA key exchange and AES message encryption over WebSockets.

#Python#RSA#AES

LOWPLANNED

← back to the orbit