classAnkitSingh:
def__init__(self):
self.role= ["SOC Analyst", "Threat Hunter", "Detection Engineer"]
self.mission="Detect what matters. Automate the rest."self.stack= ["Splunk", "Python", "Sigma", "TheHive", "Scikit-Learn"]
self.researching="LLM security & prompt-injection defense"self.frameworks="MITRE ATT&CK"defphilosophy(self):
return"Detection without response is just noise — I build the whole loop.""Security isn't just about detecting everything; it's about detecting what matters and automating the rest."
- 🔭 Building end-to-end, AI-powered detection pipelines
- 🧪 First-author research on LLM agent security in SOC triage
- 🎯 Targeting SOC / Threat Hunting / Detection Engineering roles
- 📜 CEH (in progress) · active on TryHackMe & Hack The Box
| Category | Technologies & Frameworks |
|---|---|
| 📡 SIEM & Log Mgmt | Splunk Enterprise · Splunk HEC · Elastic (ELK) |
| 🛡️ Endpoint & Network Telemetry | Sysmon (SwiftOnSecurity) · Suricata IDS · Windows Event Logs |
| 🎯 Detection & Intel | MITRE ATT&CK · Sigma · Atomic Red Team · YARA |
| ⚙️ Automation & SOAR | TheHive · Python · PowerShell · Bash |
| 🧠 Data Science & ML | Scikit-Learn (Isolation Forest) · Pandas · NumPy |
| 🤖 AI Security | LLM Security · Prompt-Injection Defense · Ollama |
flowchart LR
subgraph EP["🖥️ Endpoints (Win / Ubuntu)"]
S["Sysmon"]
SU["Suricata IDS"]
end
subgraph ING["📥 Ingestion"]
UF["Universal Forwarders"]
end
subgraph CORE["🧠 CogniSOC Core"]
SP["Splunk SIEM"]
ML["Isolation Forest ML\n↓75% noise · 88% precision"]
CE["6-Rule Correlation\n(ATT&CK-mapped)"]
end
subgraph RESP["🚨 Response"]
TH["TheHive SOAR (API)"]
AN["👤 Analyst Triage"]
end
S --> UF
SU --> UF
UF --> SP --> ML --> CE
CE -->|Low severity| DROP["🔕 Suppress"]
CE -->|High fidelity| TH --> AN
💡 Click each project to expand the deep-dive.
🧠 CogniSOC — End-to-End AI-Powered SOC
A complete, production-style SOC pipeline built from scratch to solve alert fatigue.
- Challenge: Rule-based SIEMs generate too much noise.
- Solution: Unsupervised Isolation Forest scores behavioral anomalies → 6-rule ATT&CK correlation engine → auto-escalation to TheHive (SOAR) via API.
- Result:88% precision · 75% alert-volume reduction across a 100-hour live-traffic simulation in a 4-machine isolated lab.
🛡️ ATT&CK-Mapped Detection Library
Version-controlled Detection-as-Code repo proving detection-engineering maturity.
- 13 tuned Sigma rules across 6 ATT&CK tactics, translated to Splunk SPL + Elastic DSL.
- Every rule validated with Atomic Red Team.
- False-Positive Tuning notes (e.g., suppressing SCCM & vuln-scanner noise) — real operational maturity.
🔍 Threat Hunting & Incident Investigation Lab
7 structured, end-to-end investigations emulating APT29 (Cozy Bear) & FIN7 tradecraft.
- PowerShell Empire C2 · Data Exfiltration · Lateral Movement (PsExec) · Credential Dumping (LSASS).
- Ships with IR playbooks, extracted IOCs, and proactive hunt hypotheses.
💉 LogPrompt-Inject — LLM SOC Triage Vulnerabilities
AI-Security research, under review at ACM AISec @ CCS.
- Research: Indirect prompt-injection against LLM SOC-triage engines via malicious telemetry (Sysmon
CommandLine, Suricatahttp_user_agent). - Findings:Defense Portability Failure & Defense Backfire across 6 open-weight + 3 frontier models — defenses that secure one model can worsen another.
- Value: LLM threat modeling + rigorous empirical methodology.
🤖 LLM-Assisted SOC Alert Triage (Injection-Hardened)
An AI triage copilot that classifies raw Sysmon/Suricata alerts and resists prompt injection.
- Engine: Telemetry in → strict JSON out (Severity · ATT&CK mapping · Next steps).
- Security layer: Applies my LogPrompt-Inject findings — Spotlighting (data-marking) + schema validation to neutralize injected instructions before the LLM sees them.
- Value: I both find the vuln and engineer the fix.
| Arena | Status |
|---|---|
| 🛡️ Certifications | Certified Ethical Hacker (CEH) — Trained |
| 🟩 TryHackMe | SOC Analyst path — in progress |
| 🟥 Hack The Box | SOC Analyst path — in progress |
| 🏴 CTF | Web · OSINT · Networking |
🥚 psst… click for a hidden easter egg
[+] You found the buried IOC. 🕵️
[+] In a real investigation, curiosity is the best detection rule.
[+] Now go pin those repos and apply. 🚀
These regenerate on their own — a self-updating snake and a 3D contribution world.
