Security Labs
Detection-as-Code
Sigma rules mapped to MITRE ATT&CK, linted and tested in CI, and compiled to Splunk, Elastic, and Microsoft Sentinel KQL — one rule, every SIEM. Detection engineering done as a pipeline, not a console click.
detection-as-code
Purple-Team Lab
Adversary emulation that validates the detections. Atomic Red Team techniques run against an instrumented endpoint; custom Wazuh rules catch each one, with a coverage matrix proving the ATT&CK techniques fire at the right severity.
purple-team-lab
SOC Automation Lab
Wazuh detection into Shuffle SOAR into TheHive case management. Endpoint telemetry, custom MITRE-mapped rules, automated enrichment and case creation. Deployed and shown live with an enrolled agent and a replayed SSH brute force.
soc-automation-lab
Secure CI/CD Pipeline
A GitHub Actions pipeline that gates every merge on four checks — SAST, secret scanning, dependency audit, tests — with custom Semgrep rules and findings routed back to the SOC.
secure-cicd-pipeline
CI/CD Supply-Chain Security
Proves the artifact, not just the source: keyless Cosign signing, a signed SBOM, grype scanning, and a Kyverno admission policy that refuses anything it can't verify.
cicd-supply-chain-security
CTI Detection Automation
Pulls indicators from live threat-intel feeds, dedupes across them, extracts the MITRE techniques, generates Wazuh rules — and emails an analyst for sign-off before anything goes live.
cti-detection-automation