junyamade
GitHub Contact

Security

Finding what the defaults miss.

SOC work end to end: attack, collect, detect, triage and report — in my own lab and in a SIEM I built. Everything below is live or on GitHub.

Lookout screenshotSecurity

Lookout

Home SOC lab · AI-assisted triage

Real attacks, real logs, five custom detections and a triage console.

  • Wazuh
  • Sysmon
  • ATT&CK
Case study Live Code
SIGNAL screenshotSecurity

SIGNAL

Self-hosted mini SIEM

Ingests Windows, Sysmon and Linux logs, runs 16 ATT&CK-mapped rules and correlates alerts into scored incidents.

  • SIEM
  • Detection
  • FastAPI · React
Code
PhishGuard screenshotSecurity

PhishGuard

Phishing analyser

SPF, DKIM, DMARC, URL and typosquat checks — all in the browser.

  • Email security
  • Privacy
Live Code

Detection coverage

8 techniques, 4 silent by default.

The out-of-the-box Wazuh ruleset against Atomic Red Team — and the rules I wrote to close the gaps.

Eight ATT&CK techniques run against the lab, whether default Wazuh rules caught them, and the custom rule I wrote
TechniqueWhat it isDefault WazuhMy rule
T1033System owner / user discoveryDiscoveryMissed100020
T1059.001Encoded PowerShellExecutionCaughtnot needed
T1547.001Registry Run keyPersistenceMissed100030
T1053.005Scheduled taskPersistencePartial100050
T1136.001Create local accountPersistenceCaughtnot needed
T1003.001LSASS memory dumpCredential accessMissed100010
T1070.004File deletionDefense evasionCaughtnot needed
T1560.001Archive for exfil (makecab)CollectionMissed100040

Method and false-positive notes in the Lookout case study.

Security skills

What I use in the lab.

Security operations

  • Alert triage
  • Log analysis
  • MITRE ATT&CK mapping
  • True / false positive verdicts
  • Incident write-ups
  • Phishing analysis (SPF · DKIM · DMARC)

Detection & lab

  • Wazuh 4.14 (SIEM)
  • Sysmon + sysmon-modular
  • Custom Wazuh rules (XML)
  • Sigma-style detection rules
  • Atomic Red Team
  • Windows event logs · EVTX
  • Ubuntu server · UTM VMs

Secure engineering

  • Input validation (zod)
  • CSP · HSTS · security headers
  • Auth, CSRF & rate limiting
  • Webhook signature checks
  • Secret scanning (gitleaks)
  • Prompt-injection defences

How I think

Three lessons from the lab.

01

A detection gap can be a telemetry gap.

You can’t alert on what you don’t collect — check the endpoint, not just the SIEM.

02

A rule that fires isn’t finished.

False positives are where tuning starts. I document them.

03

AI output is data, not instructions.

Validated, never executed. I make the final call.

Training

Security+ & SOC training

CompTIA Security+ (SY0-701) and TryHackMe SOC Level 1 in progress — every lab lesson is mapped to a Security+ domain.

Lookout case study Contact