15 interfaces, 13 up/up. Each shipped project has a public repo and a full write-up covering what worked, what broke, and what I'd change.
A two-VM detection lab: Suricata IDS and Zeek watching the same interface, Wazuh as the SIEM, Grafana and Loki for hunting. Custom Suricata rules, a scripted attack simulation with a beacon-detection script, and a real 24-hour threat hunt through the SIEM's own alert volume.
Threat intelligence run end to end in Microsoft Sentinel: inventory the built-in feeds with KQL, mine 220 brute force IPs from my own logs, turn them into STIX indicators with a standard-library Python script, match them against logons, network flows and 90 days of history, then prove a file hash rule with EICAR and wire three analytics rules.
A growing casebook of threat hunts reconstructed from raw telemetry with KQL, one folder per incident with the same file set every time. Incident 01 traces a Microsoft 365 Copilot prompt injection from one poisoned email to 13 exposed files and image-link exfiltration, with ATT&CK and ATLAS mapping, five detections and a formal report.
A Netmiko CLI that SSHes into every device in an inventory file, backs up the running config, diffs it against the last backup, and emails an alert only when something changed. Tested against a real two-router VyOS lab built with containerlab, which caught two bugs a mocked test suite never could.
A dependency-free Python CLI that plans VLSM subnetting from a CSV of departments and host counts using the ipaddress standard library. 30 tests, and an allocation order that stops wasted address space.
Nine real packet captures: DNS, TCP, HTTP vs HTTPS, ICMP, packet loss, ARP, DHCP, Telnet vs SSH, and FTP. Each one generated, read, and explained by hand for CCNA study.
A vulnerability management program from policy to remediation: stakeholder buy-in, Tenable scanning across Windows and Linux targets, and ten confirmed fixes in PowerShell and Bash, including the two attempts that didn't work out.
Lynis and rkhunter against a real Ubuntu workstation: three warnings triaged, a crashed Fail2ban jail caught, and an honest account of the thirty eight suggestions I skipped.
Active Directory on Windows Server 2022: OU design, Fine-Grained Password Policies, Windows LAPS, delegated help desk rights, WSUS patching, scripted provisioning, and a backup I actually tested.
Onboarding, offboarding, groups, delegated admin roles, mail flow, and service health, automated with the Microsoft Graph PowerShell SDK, with a real audit trail.
A Freshservice service desk built from scratch: three SLA tiers, a category taxonomy, a service catalog, and twenty simulated helpdesk tickets modeled on a real support queue.
A five-document IT runbook covering onboarding, offboarding, password reset, laptop setup, and network troubleshooting, built from NIST, CIS Controls v8, and Microsoft's own documentation.
A Microsoft 365 test tenant on the path that is actually open to individuals, the 30-day E3 trial: users across three departments, MFA switched on before anything else, and the cancellation step that avoids the bill.
An enterprise network lab built in Cisco Modeling Labs (CML) on real Cisco IOS images instead of a simulator: core, distribution and access layers, VLANs, routing and redundancy, documented with the full topology, addressing plan and verification commands.
Study notes, lab write-ups, and a spaced-repetition flashcard deck for CCNP Security, replacing the CCNA-Notes project now that I've moved on to the professional-level security track.
% No interfaces match this filter.
up/up shipped up/down in progress admin down planned