up/up CCNA · Vancouver, BC · open to opportunities
I'm Trey, a CCNA-certified network engineer. I build networks in the lab, break them on purpose, and write up the fix: routing labs, Python automation, and a home SOC, mistakes included.
A two-VM detection lab built on a laptop budget: Suricata and Zeek watching the same interface, Wazuh as the SIEM, Grafana and Loki for hunting. Then a scripted attack, predictions written down before the first packet, and a 24-hour threat hunt read cold.
Five posts, design through triage, including the parts that went wrong.
Every project is a port. Green means shipped with a write-up and a public repo.
| Port | Name | Status | Vlan | Description |
|---|---|---|---|---|
| Gi1/0/1 | SOC-HomeLab | up/up | 30 SECURITY | A two-VM detection lab: Suricata IDS and Zeek watching the same interface, Wazuh as the SIEM, Grafana and Loki for hunting. |
| Gi1/0/2 | Threat-Intel-Sentinel | up/up | 30 SECURITY | Threat intelligence run end to end in Microsoft Sentinel: inventory the built-in feeds with KQL, mine 220 brute force IPs from my own logs, turn them into STIX indicators with a standard-library Python script, match them against logons, network flows and 90 days of history, then prove a file hash rule with EICAR and wire three analytics rules. |
| Gi1/0/3 | Threat-Hunting-Casebook | up/up | 30 SECURITY | A growing casebook of threat hunts reconstructed from raw telemetry with KQL, one folder per incident with the same file set every time. |
| Gi1/0/4 | Py-ConfigBackup | up/up | 20 AUTOMATION | A Netmiko CLI that SSHes into every device in an inventory file, backs up the running config, diffs it against the last backup, and emails an alert only when something changed. |
| Gi1/0/5 | Py-SubnetCalc | up/up | 20 AUTOMATION | A dependency-free Python CLI that plans VLSM subnetting from a CSV of departments and host counts using the ipaddress standard library. |
| Gi1/0/6 | Wireshark-Captures | up/up | 10 NETWORK | Nine real packet captures: DNS, TCP, HTTP vs HTTPS, ICMP, packet loss, ARP, DHCP, Telnet vs SSH, and FTP. |
| Gi1/0/7 | Vuln-Mgmt-Program | up/up | 30 SECURITY | A vulnerability management program from policy to remediation: stakeholder buy-in, Tenable scanning across Windows and Linux targets, and ten confirmed fixes in PowerShell and Bash, including the two attempts that didn't work out. |
up/up shipped up/down in progress admin down planned
One-page desk references for CCNA, security and help desk work. Free PDF and print.
Six prompt patterns (few-shot, step by step, structured output, critique, chaining, ask first), when to use each, how to stack them and how to use them safely.
Claude, ChatGPT and Geminiv1.0 · Oct 3, 2026
Lab walkthroughs, security write-ups, and automation notes. Newest first.
REA lets an AI coding agent decompile and explain software you have no source for, and it trended hard in October 2026. Past the hype: what it actually does, why it is not magic, the legitimate uses, what to change if you ship client-side code, and the prompt-injection risk of feeding a binary to an AI.
SEC-5· 28 minIncident 01 of my Threat Hunting Casebook. A poisoned email hijacked a Microsoft 365 Copilot session: no malware, no stolen password, 13 sensitive files read and leaked through Markdown image links. How I proved it with KQL across three audit tables, ruled out the alternatives, and where the evidence ends.
SEC-5· 12 minPart 2 of the Sentinel threat intelligence project. A standard-library Python script turns 220 failed-logon IPs into scored STIX 2.1 indicators with an audit file, Sentinel imports them, and KQL matches them against logons, NSG flows, outbound connections and a 90-day retrohunt. Not everything came back clean.
SEC-5· 11 minPart 1 of a three-part Microsoft Sentinel threat intelligence project. I inventory the built-in indicators with KQL, learn why active row counts mislead, mine 220 brute force source IPs from my own failed logons, and run the failed-then-succeeded check that separates noise from an incident.
I'm a CCNA-certified network engineer with a growing focus on network security. I learn by building: every new topic becomes a lab, and every repetitive lab task becomes a Python script.
Right now I'm deep in routing protocols, VLAN design, and using Python (Netmiko, ipaddress, scapy) to automate the boring parts of network administration. On the security side, I run a small home SOC and write up what I find here, including the things I got wrong the first time.
! skills snapshot, last change Oct 20, 2026 hostname trey certification ccna active routing ospf eigrp static switching vlan stp etherchannel language python3 powershell bash library netmiko ipaddress scapy security acl suricata zeek wazuh pfsense systems windows-server ad m365 linux location vancouver-bc ! end
