Featured Lab Environment
SOC Home Lab
Designed and built a virtual Security Operations Center environment for attack simulation, telemetry collection, detection development, and incident investigation. This lab mirrors modern enterprise telemetry pipelines: adversarial simulations conducted from Kali Linux traverse a segmented pfSense firewall into a Windows Server Active Directory domain. Host and authentication activities are captured via fine-grained Sysmon configurations and ingested into Splunk for detection creation, SPL queries, and investigative triage.
Lab Telemetry & Attack Architecture Flow
Kali LinuxAttacker / Threat Emulation→
pfSenseNetwork Boundary & Segmentation→
Windows Server / ADTarget Domain & Host Activity→
Sysmon AgentHigh-Fidelity Telemetry Logging→
Splunk Universal ForwarderSIEM Ingestion & Indexing→
Detection & InvestigationSPL Rules, Triage & Incident Analysis
Key Engineering Activities & Investigations
•Adversarial attack simulation across network and endpoint boundaries
•Windows Server and Active Directory enterprise telemetry generation
•Custom Sysmon XML configuration for high-fidelity process and network logging
•Splunk data ingestion, source typing, and index architecture
•Development of custom SPL detection rules and correlation queries
•Alert validation, false-positive elimination, and threshold tuning
•Full incident triage, root-cause investigation, and documentation
•Deep packet inspection and protocol analysis using Wireshark
Tech Stack:SplunkSysmonActive DirectoryWindows ServerpfSenseKali LinuxWiresharkVirtualBox