Security tools, lab environments, and research built from scratch — every project here is something I designed and deployed myself.
An authenticated File Integrity Monitoring platform built from scratch. The Python agent hashes files with SHA-256, detects created, modified, and deleted files, and reports to a FastAPI backend with SQLite history, dashboard authentication, severity labels, and optional n8n webhook automation.
Deployed a full ELK Stack (Elasticsearch, Logstash, Kibana) on cloud infrastructure from scratch. Enrolled a Windows VM via Elastic Agent and configured Elastic Defend endpoint security policies — building and testing real detection rules for login monitoring and File Integrity Monitoring.
Deployed a Windows VM on Microsoft Azure and deliberately exposed RDP to the internet to capture real-world brute-force attacks. Independently analysed attacker IP patterns, authentication failure clustering, and timing-based attack behaviour over 24-48 hours. Documented as a SOC-style incident report.
Educational mini SIEM web app for learning log ingestion, normalization, detection rules, alert generation, and investigation workflows. Built to explain how SOC pipelines turn raw logs into actionable detections.