SOC / Blue Team — Splunk SPL detections, PCAP/Suricata investigations, IR triage. Student at UNC Wilmington.
I build practical detections, investigate alerts end-to-end, and document the work like a real SOC would: triage → pivot → timeline → IOCs → detection → tuning.
LinkedIn · LetsDefend · Hack The Box
| Project | What it is |
|---|---|
| soc-triage-tool | React app that triages a pasted alert (syslog, Windows Event, Suricata, Zeek, CEF) — detects the log format, scores severity, and maps it to MITRE ATT&CK. Live demo |
| splunk-detections | SPL detections with data requirements, investigation pivots, MITRE mapping, and false-positive tuning notes for each one |
| llm-cybersecurity-benchmark | Head-to-head benchmark of LLMs on SOC analysis tasks — detection engineering, threat reasoning, IR scenarios. Live dashboard |
| attack-path-modeler | Parses Nessus scan data into an attack graph, ranks lateral-movement paths by exploit difficulty, and visualizes it with matplotlib + an interactive D3 dashboard |
| rmf-security-assessment-sample | A full NIST RMF assessment lifecycle worked end-to-end for a fictional case-management system — categorization through ATO recommendation |
| windows-event-labs | Hands-on labs on high-signal Windows Security + Sysmon event IDs, with process/network correlation writeups |
| pcap-investigations | Network investigation case studies — PCAP → IOCs → timeline → SIEM pivots |
| soc-triage-playbooks | Alert triage checklists and escalation thresholds by alert type |
| nmap-log-analysis | Recon-detection writeup correlating Nmap scan activity across Wireshark, Suricata, and Splunk |
- Validate — is it real, what's the evidence
- Pivot — across host, user, and network indicators
- Timeline — reconstruct sequence, capture IOCs
- Contain / escalate — with justification, not guesswork
- Tune — turn the investigation into a detection or a fix, so it's faster next time
Splunk SPL · Windows Event Logs & Sysmon · Wireshark · Suricata · Nmap / Nessus · MITRE ATT&CK mapping
Detection pack: encoded/obfuscated PowerShell, local admin creation + first-logon correlation, service-creation persistence, password-spray indicators, and anomalous outbound DNS.