Splunk Linux Auth Monitoring
SIEM- Splunk Enterprise
Splunk Linux Authentication Monitoring system built using a Linux-based log source pipeline and Splunk SIEM for centralized log ingestion, detection, and analysis. The project demonstrates SOC-driven monitoring practices focused on authentication security, threat detection, and log correlation.
What the system does:
Continuously collects and analyzes Linux authentication logs (such as SSH login attempts, sudo access, and system authentication events) in Splunk, detecting suspicious login behavior, unauthorized access attempts, and anomalous user activity in real time.
What it protects:
Protects Linux systems from unauthorized access by monitoring authentication mechanisms, privileged escalation attempts, and user session activity, supporting the Confidentiality and Integrity pillars of the CIA Triad.
How it defends:
Centralized log ingestion using Splunk forwarders or syslog pipelines
Real-time detection of failed and successful login anomalies
Brute-force attack identification through repeated authentication failures
Privilege escalation monitoring via sudo and root access tracking
Alerting dashboards and correlation searches for SOC visibility
Searchable logs for incident investigation and forensic analysis
Threats & attacks detected:
SSH brute-force attacks and credential stuffing attempts
Unauthorized sudo or root privilege escalation
Suspicious login patterns from unknown or high-risk IP addresses
Account compromise indicators (impossible logins, unusual access times)
Internal misuse of privileged accounts
Brute-force persistence attempts across multiple services
SOC use case:
Used to monitor Linux authentication activity across servers, detect early signs of compromise, and generate alerts for SOC analysts. The system enables correlation of authentication events with network and endpoint telemetry in Splunk, helping analysts investigate attacks, identify compromised accounts, and respond to security incidents in real time..
Github
Microsoft Sentinel Threat Hunting Lab
SIEM- Microsoft Azure.
Microsoft Sentinel Threat Hunting Lab built using Microsoft Sentinel (cloud-native SIEM/SOAR) integrated with Azure Log Analytics, designed to simulate real-world security operations center (SOC) threat hunting and incident investigation scenarios. The project demonstrates advanced detection engineering, KQL query development, and proactive threat hunting methodologies.
What the system does:
Collects and analyzes security telemetry from Azure resources, Windows/Linux endpoints, and simulated attack scenarios within Microsoft Sentinel. It enables proactive hunting for suspicious behavior, anomalies, and hidden indicators of compromise (IOCs) using Kusto Query Language (KQL).
What it protects:
Protects cloud and hybrid environments by identifying threats across identities, endpoints, applications, and network activity. It supports the Confidentiality, Integrity, and Availability (CIA) triad by detecting early-stage attacks before escalation.
How it defends:
Centralized log ingestion via Azure Monitor and Log Analytics workspace
Advanced KQL-based threat hunting queries for anomaly detection
Correlation of multi-source security events (identity, network, endpoint)
Detection rules for suspicious authentication and privilege escalation
Incident creation and alert triaging within Microsoft Sentinel
Automated response capabilities using Sentinel playbooks (Logic Apps)
Dashboards and workbooks for real-time security visibility
Threats & attacks detected:
Suspicious sign-in activity (impossible travel, atypical locations)
Brute-force and password spray attacks against Azure AD
Privilege escalation and abnormal role assignment activity
Malware execution indicators and suspicious process behavior
Lateral movement across cloud and hybrid resources
Data exfiltration patterns and unusual outbound connections
Misconfigured or abused cloud resources
SOC use case:
Used in a SOC environment to proactively hunt for threats across cloud infrastructure, investigate security incidents, and correlate alerts across multiple data sources. The lab simulates real-world attack scenarios and trains analysts to detect stealthy adversaries using Microsoft Sentinel, improving detection coverage, incident response speed, and overall cloud security posture.
Windows Security Log Analyzer
SOC Simulation
Windows Security Log Analyzer built with Python for automated Windows Event Log collection, parsing, and security analysis. The system demonstrates core SOC monitoring, threat detection, and incident investigation practices by transforming raw Windows security events into actionable security insights.
What the system does:
Continuously analyses Windows Security Event Logs to identify suspicious authentication activity, account changes, privilege escalation attempts, and other security-relevant events. The system parses event data, categorizes security events, and highlights indicators of compromise for further investigation.
What it protects:
Protects Windows endpoints and servers by providing visibility into user activity, authentication events, administrative actions, and security policy changes, supporting the Confidentiality, Integrity, and Availability pillars of the CIA Triad.
How it defends:
- Automated collection and parsing of Windows Security Event Logs
- Detection of failed and successful authentication anomalies
- Monitoring of account creation, deletion, and privilege changes
- Identification of suspicious administrative activity
- Structured logging and event categorization for investigations
- SOC-ready output designed for SIEM ingestion and correlation
- Threats & attacks detected:
- Brute-force and password spraying attacks
- Unauthorized account creation and privilege escalation
- Compromised user accounts and insider threats
- Suspicious administrative actions and policy modifications
- Lateral movement indicators through authentication events
- Persistence techniques involving account manipulation
SOC use case:
Used by security analysts to monitor Windows environments for suspicious activity, investigate authentication anomalies, and identify indicators of compromise. The generated security events can be forwarded to a SIEM for correlation with endpoint, network, and cloud telemetry, enabling faster detection, triage, and incident response workflows.
IOC Enrichment and Threat Intelligence Engine
SOC Simulation
IOC Enrichment & Threat Intelligence Engine built with Python and integrated threat intelligence workflows. The system demonstrates core cyber threat intelligence (CTI), detection engineering, and SOC investigation concepts by automatically enriching Indicators of Compromise (IOCs) with contextual threat data from multiple intelligence sources.
What the system does:
Automatically analyzes and enriches IP addresses, domains, URLs, file hashes, and other IOCs by querying threat intelligence feeds and reputation services, providing analysts with actionable context to accelerate investigations and incident response.
What it protects:
Protects organizations from known malicious infrastructure, malware campaigns, phishing operations, and threat actor activity by improving visibility into suspicious indicators and enabling faster threat identification.
How it defends:
- Automated IOC enrichment and reputation analysis
- Threat intelligence correlation across multiple data sources
- Malicious IP, domain, URL, and hash identification
- Risk scoring and threat classification
- Structured logging and investigation-ready reporting
- Integration-ready outputs for SIEM and SOC workflows
- Threats & attacks detected:
- Known malicious IP addresses and command-and-control infrastructure
- Phishing domains and malicious URLs
- Malware and ransomware file hashes
- Threat actor infrastructure and campaign indicators
- Botnet communication endpoints
- Indicators associated with data exfiltration and persistence activity
SOC use case:
Used by SOC analysts during threat hunting, alert triage, and incident response to enrich suspicious indicators with threat intelligence context. The system helps analysts rapidly determine indicator severity, correlate threats across multiple sources, prioritize investigations, and feed enriched intelligence into SIEM platforms for advanced detection and response workflows.
File Sentinel
File Integrity Monitoring (FIM) System
A portfolio-ready File Integrity Monitoring (FIM) application built with a Python Flask backend and a modern web frontend (JavaScript, HTML5, CSS3). The system demonstrates core cybersecurity detection concepts and SOC-aligned monitoring practices.
What the system does:
Continuously monitors files and directories for unauthorized changes by comparing live file states against SHA-256 integrity baselines, generating alerts when violations occur.
What it protects:
Protects critical system, application, and configuration files from unauthorized modification, deletion, or insertion, supporting the Integrity pillar of the CIA Triad.
How it defends:
-
SHA-256 baseline hashing and integrity verification
-
Detection of file additions, deletions, and modifications
-
Alerting and structured logging for investigation
-
Secure authentication and session management
-
SOC-ready logs designed for SIEM integration
Threats & attacks detected:
-
Malware persistence and post-exploitation activity
-
Web shells and backdoor scripts
-
Malicious configuration changes
-
Log tampering and ransomware-related file changes
SOC use case:
Used to monitor high-value directories, trigger integrity alerts, and feed events into a SIEM for correlation with authentication, network, and endpoint data—enabling analysts to identify compromised hosts and escalate incidents.
SentinelLite SIEM
Security Information and Event Management.
A professional, portfolio-ready log-based intrusion detection and monitoring system built with Python, Flask, TypeScript, and React. This application is designed to demonstrate core cybersecurity principles, SOC-style thinking, and full-stack development skills to potential employers. It provides a clean, intuitive dashboard for monitoring and analyzing security events in real time.
What the system does:
The SIEM dashboard collects, processes, and visualizes security-related logs from various sources. It identifies suspicious activity and potential threats, prioritizes incidents based on severity, and enables SOC-style monitoring through an interactive interface.
What it protects:
The system is intended to protect IT infrastructure and user accounts by detecting unauthorized access, anomalous behavior, and policy violations. Examples include repeated failed login attempts, access outside normal hours, and abnormal request patterns.
How it defends:
-
Rule-based anomaly detection: Monitors logs for patterns indicative of intrusion attempts.
-
Real-time alerting: Notifies users of security events with prioritization (Low, Medium, High).
-
Detailed event inspection: Allows investigation of raw logs for forensic analysis.
-
Secure access: Implements authentication and session management to safeguard the dashboard itself.
-
Modular architecture: Designed for scalability, enabling integration with additional security tools and data sources.
Key Features:
-
Centralized security dashboard with live system statistics
-
Log analysis interface for reviewing authentication and access events
-
Detection and alerting of suspicious activity and potential intrusions
-
Severity-based alert management and prioritization
-
Detailed event inspection with raw log access
-
Secure authentication and session handling
-
Modular frontend architecture ready for backend scalability
SECENGINE
Security Misconfiguration Detection Engine
A professional, portfolio-ready cybersecurity application developed with Python and Flask, designed to demonstrate application security, secure backend engineering, and security automation skills to recruiters and hiring managers.
What the System Does:
SecEngine proactively detects security misconfigurations in application and cloud environments. By scanning configuration files and deployment settings, it identifies vulnerabilities that could be exploited if left unaddressed.
What It Defends:
-
Web and API backends against misconfiguration-based attacks
-
Cloud environments (e.g., AWS, Azure, GCP) against insecure settings
-
Authentication and access controls from improper exposure
-
Deployment pipelines against security flaws introduced during configuration
How It Defends:
-
Performs rule-based scanning of application and cloud configuration files to detect insecure settings.
-
Classifies findings with severity levels (Low / Medium / High) for actionable prioritization.
-
Provides clear remediation guidance for each detected misconfiguration.
-
Uses secure authentication and token-based access to protect sensitive operations.
-
Maintains scan history and audit logs to support compliance and review.
-
Follows API-first design and secure backend architecture to model real-world AppSec and DevSecOps practices.
Key Features:
-
Automated scanning of configuration files for common application and cloud misconfigurations
-
Rule-based detection engine with severity classification
-
Secure authentication and protected routes with token-based access
-
Detailed findings and remediation recommendations for security improvements
-
Audit-ready scan history tracking for compliance and reporting
-
Backend-driven, API-first architecture for scalable and secure operations
SecEngine is a showcase of practical cybersecurity skills, demonstrating how to proactively defend digital assets through automation, secure design, and risk-based configuration analysis.
NexusGO E-Commerce Storefront
A desktop- and mobile-friendly e-commerce storefront built on Shopify, designed to provide a modern and seamless online shopping experience. The store focuses on user-friendly navigation, clean design, and efficient inventory management. Products are being uploaded progressively as part of the store setup.
The storefront is currently in development, with inventory being added and layout optimisations underway. This work lays the foundation for future enhancements, including custom Shopify features, integrated analytics, and advanced e-commerce functionalities.
Key Features:
-
Clean, responsive design for desktop and mobile
-
Intuitive product navigation and categorisation
-
Product pages with descriptions, images, and pricing
-
Inventory management and product upload in progress
-
User-friendly shopping cart and checkout experience
-
Customisable Shopify templates to match brand identity
-
Foundation for future analytics and sales tracking
Tech Stack: Shopify, Liquid, HTML, CSS, JavaScript
Nexus Order Management System
A modern desktop-style ticketing application built using TypeScript, ReactJS, Next.js, and Electron. It is designed for small ICT teams to manage client support tickets in a lightweight and efficient way. The system features a clean graphical interface, organized ticket workflows, and local JSON-based data storage, making it ideal for offline or internal support environments.
Currently being enhanced with basic ticket reporting, allowing for insights such as total tickets, open vs closed counts, and issue categories. This will form the foundation for future data analytics capabilities.
Key Features:
-Clean, user-friendly GUI
-Add, view, update, and delete support tickets
-Auto-generated Ticket IDs
-Client details (name and surname) and urgency tracking
-Basic ticket reporting (e.g., total tickets, open vs. closed, common issue types)
-Local JSON file storage
-Desktop-native performance via Electron
Tech Stack: TypeScript, JavaScript, ReactJS, Next.js, Electron.js, Node.js, JSON
Visit Github
CYBERSHIELD
Password Strength & Entropy Analyzer
A professional, portfolio-ready security-focused dashboard application built with TypeScript, ReactJS, Next.js, and Electron. The system is designed to analyze and evaluate password security, providing users and organizations with actionable insights into password strength, entropy, and vulnerability risk.
What the system does:
-
Evaluates passwords based on entropy calculations and complexity rules.
-
Provides real-time feedback on password strength and potential weaknesses.
-
Logs historical password assessments for trend tracking and security auditing.
-
Offers a clean, interactive dashboard for monitoring multiple password evaluations.
What it defends:
-
Protects user accounts and sensitive systems by identifying weak or predictable passwords.
-
Helps organizations implement stronger password policies and reduce the risk of unauthorized access.
How it defends:
-
Uses entropy-based analysis to quantify password unpredictability and resistance to brute-force attacks.
-
Displays visual indicators for immediate recognition of weak, medium, and strong passwords.
-
Tracks historical assessments to highlight recurring security gaps and inform proactive defenses.
Key Features:
-
Intuitive GUI: User-friendly interface for monitoring and managing password evaluations.
-
Status panels: Real-time visual indicators of password security levels.
-
Historical logging: Stores and displays past analysis for auditing and improvement tracking.
-
Modular design: Scalable components for maintainability and future feature expansion.
-
Responsive desktop interface: Electron-powered cross-platform support.
-
Simulated real-world scenarios: Static mock data to demonstrate system capabilities.
This application demonstrates full-stack cybersecurity awareness, blending secure application design with modern front-end and back-end integration, making it ideal for a professional portfolio targeting security and development roles.
Nova .
A vibrant and responsive WordPress website created as a practice project, designed to showcase events, restaurant specials, and lifestyle updates in a fun and engaging way. The site highlights upcoming happenings, buzzing restaurant deals, and community-driven content — all built with WordPress and customised using themes, plugins, and page builders for a modern, user-friendly experience.
Subtopic: Dynamic Website (Sitepad, Themes/Plugins, Page Builder)
NexusGO E-Commerce Storefront
A desktop- and mobile-friendly e-commerce storefront built on Shopify, designed to provide a modern and seamless online shopping experience. The store focuses on user-friendly navigation, clean design, and efficient inventory management. Products are being uploaded progressively as part of the store setup.
The storefront is currently in development, with inventory being added and layout optimisations underway. This work lays the foundation for future enhancements, including custom Shopify features, integrated analytics, and advanced e-commerce functionalities.
Key Features:
-
Clean, responsive design for desktop and mobile
-
Intuitive product navigation and categorisation
-
Product pages with descriptions, images, and pricing
-
Inventory management and product upload in progress
-
User-friendly shopping cart and checkout experience
-
Customisable Shopify templates to match brand identity
-
Foundation for future analytics and sales tracking
Tech Stack: Shopify, Liquid, HTML, CSS, JavaScript