Skip to content
Home

Projects & Labs

Things I’ve built, and what they taught.

Each of these is one real thing, built end to end. The write-up covers the design, what got built, what broke on the way, and the lesson that stuck. Not demos.

  • Live2026

    Internet-facing SSH honeypot → Microsoft Sentinel

    An SSH honeypot disguised as a finance-database server, wired into Sentinel through a CEF pipeline. I built it to get genuine attacker telemetry for detection engineering.

    4 evidence layers·10 analytics rules·minutes to first brute force

    • Azure VM
    • nftables
    • Suricata
    • Cowrie
    • CEF
    • Microsoft Sentinel
  • Ongoing2026

    38 ATT&CK-mapped analytics rules

    Every rule is written for a small, quiet tenant and mapped to a tactic. Cadence and grouping are tuned so the output is signal, not a queue of duplicates.

    38 rules·6 categories·5 data sources

    • Microsoft Sentinel
    • KQL
    • MITRE ATT&CK
    • Analytics rules
    • Entity mapping
  • Live2026

    Threat Radar: a live CTI dashboard at the edge

    A static site can't fetch cross-origin threat feeds. An edge worker does it server-side and caches the result, so the upstreams get hit twice an hour no matter the traffic.

    3 source types·30 min edge cache·0 API keys

    • Cloudflare Pages Functions
    • Next.js (static export)
    • TypeScript
    • CISA KEV
    • ransomware.live
    • RSS
  • Ongoing2025

    Secretless SOC automation

    Automation that authenticates as itself and enriches freely, but never takes a consequential action without an analyst in the loop.

    0 stored secrets·3+2 playbooks / runbooks

    • Azure Logic Apps
    • Azure Automation
    • Azure Key Vault
    • Managed identity
    • Microsoft Graph
    • Sentinel automation rules