soc-analysis

🛡️ Modular Python framework for Cybersecurity LLM agents, purple team automation, log triage, and detection engineering in lab environments.

A command-line tool for analysing Suricata EVE JSON alert logs and converts them to .txt readable output for SIEM analysis. Built with Python, 2026.

"A comprehensive network security lab featuring FortiGate NGFW configuration, firewall policy management, and real-time traffic monitoring and analysis."

Windows security investigation analyzing failed authentication attempts using Event Viewer and Event ID 4625.

This project required the built-in of high-confidence detections in Microsoft Sentinel using KQL, focusing on identity security and reducing false positives. This project targets MFA bypass and correlates signals like impossible travel and abnormal access patterns to detect real-world attacks.

IT Support and SOC portfolio project with practice scenarios, questions, and a React based SOC and IT simulator

Investigated suspicious Microsoft 365 sign in activity using portal triage, containment actions like session revocation and stronger authentication, then validated remediation and practiced structured KQL hunting patterns with Azure Monitor Logs demo data.

Cybersecurity Engineering student passionate about technology, security, and continuous learning. Building practical projects, exploring emerging technologies, and developing skills to solve real-world challenges.

Network traffic investigation using Wireshark to analyze HTTP traffic and identify network communication patterns.

SOC-style phishing incident investigation analyzing a multi-vector job scam campaign. Performed email header analysis, URL inspection, and IOC extraction; mapped attack techniques to MITRE ATT&CK and documented findings with remediation and responsible disclosure.

Practicing to find true positive alerts and commenting the process

SOC Tier 1 lab for log analysis, attack simulation, incident documentation, and basic security automation.

Professional phishing email analysis report and employee security awareness framework for corporate risk mitigation.

Artefact conçu pour déplacer la surface d'action vers la représentation opérationnelle d'un système défensif. Pas d'exploitation, pas de persistance. L'espace cognitif comme terrain. Ce qui cesse d'être observé pendant la qualification est l'espace dans lequel il opère.

SOC investigation and ransomware analysis project focused on WannaCry simulation, IOC collection, and MITRE ATT&CK mapping.

The technical analysis of a multi-stage phishing campaign targeting university infrastructure.

SOC alert investigations, SIEM practice labs, and incident analysis exercises completed on LetsDefend.

Network traffic investigation using Wireshark to analyze DNS, TCP, TLS and HTTP traffic.

Análisis forense de tráfico de red y auditoría de ciberseguridad con Wireshark. Incluye reconstrucción de paquetes, filtros de inspección profunda (DPI), detección de ataques MITM (ARP Spoofing), escaneo de puertos y extracción de artefactos.

AI-assisted SOC triage pipeline - real AD attack alerts fed through Claude API for automated Tier 1 analysis. Includes analyst dashboard, AI vs manual comparison, and documented hallucination found during failure testing.