Cybersecurity student focused on Blue Team, SOC operations, Active Directory security, DFIR and detection engineering.
Portfolio · LinkedIn · GitHub · Email
- Active Directory forensics - event ingestion, timeline reconstruction, correlation and structured reporting.
- Sigma rule governance - duplicate detection, weakness scoring, ATT&CK coverage and CI-friendly quality checks.
- Detection labs - practical environments for validating logs, alerts, attack traces and SIEM investigation workflows.
- Microsoft 365 / Entra ID administration - user management, Conditional Access, workstation hardening and basic incident triage.
- Defensive infrastructure - lab deployment, monitoring stack documentation and security tooling around Windows/Linux environments.
-
ADFT - Active Directory Forensic Toolkit for Windows event ingestion, correlation, timeline reconstruction and reporting.
Repository -
RuleScope - Sigma Rule Governance CLI for rule quality, catalog hygiene, duplicate detection and ATT&CK coverage.
Repository -
GOAD-Light Deployment - deployment guide for a vulnerable Active Directory lab with a defensive monitoring stack.
Repository
- Languages: Python, PowerShell, Bash
- Systems: Linux, Ubuntu, Windows, Docker
- Security: Splunk, Wazuh, Elastic, Wireshark, Suricata, Zeek, OpenCTI
- Cloud: Microsoft 365, Entra ID, Azure, Intune
- Active Directory security
- DFIR methodology
- SOC investigation
- Detection engineering
- SIEM workflows
- Infrastructure hardening