Professional work and labs, written up with my part kept separate from the team's and the status stated plainly. Client names, hosts, addresses, and incident artifacts are left out.
Matches titles, summaries, and tags. Results update as you type.
A cloud-to-cloud migration of a production IBM QRadar deployment: destination preparation, configuration restore, historical Ariel data transfer, collector connectivity, licensing, and cutover dependencies.
A quarantined email passed SPF/DKIM and sandbox detonation and carried no links or attachments. Pivoting on it uncovered a 90-day, multi-domain reply-bait campaign.
Internet-exposed production servers at 100% CPU, with isolation ruled out by uptime requirements. Baselining against a known-good host exposed masquerading malware; a default-deny egress firewall cut C2 and XMRig mining traffic.
A SIEM audit for a microfinance bank. Corrected parsers and DSM/event mappings that sent 50+ assets into SIM Generic (unknown/unparsed events down 80%), and integrated 190 previously unmonitored assets.
A recurring QRadar instability caused a roughly one-minute service crash every hour. The root cause was expired internal certificates; renewing the chain removed the outage window.
A self-hosted Wazuh lab: standalone and two-node cluster deployments, Windows and Linux agents, TLS, perimeter controls, and load testing around 5–6K EPS.
A practical hardening loop on an internet-facing lab server: reduce exposure, scan, remediate, and re-scan until two findings remained.
Nothing matches that search in the selected category. Try a broader word, or clear the filters to see everything.