Portfolio website — case studies & résumé · Portfolio projects · Open-source integrations · Run a project
This is the code and evidence library. The portfolio website presents the case studies, résumé and credentials.
| Work type | What the label means | Browse |
|---|---|---|
| Portfolio project | Analysis, lab implementations and software developed for the portfolio, plus clearly identified training and private-research summaries. Data sources and execution limits stay attached to each case. | Portfolio work |
| Open-source integration | A tool written by other authors, with collection-developed example inputs, a runner and recorded results. | Integration examples |
| Third-party source | Unmodified copies of the original tool code, with author credits, licenses and pinned revisions. | Upstream source directory |
The following sections describe the portfolio's work. Public recorded datasets, synthetic labs, prior training and private architecture summaries are identified separately.
| Project | Result and scope | Open |
|---|---|---|
| Active Directory investigation | Independently correlated 25,993 host events and 1,121 packets from OTRF's recorded emulation; six qualified findings. | Code and report · Incident PDF · Visual case |
| Splunk authentication detection | Corrected the inclusive 600-second boundary; the saved synthetic-lab result improved from 3/5 to 5/5 expected findings. | Query and evidence · Saved result · Visual case |
| Splunk indexed SOC confirmation | Separate authorized synthetic live run: 70 source-equal indexed events, 5/5 original findings, and one native scheduled alert with its exact result retained before shutdown. No real incident. | Live confirmation · SOC case study · Indexed SPL |
| Python SOC Triage Assistant | Executed CSV/JSON walkthrough: 13 accepted events, three review candidates and six quarantined rows; partial processing stays visible. | Tool and usage · Recorded JSON · Visual case |
| Project | Tools and evidence | Portfolio |
|---|---|---|
| Synthetic Linux CIS access-hardening review | Credited upstream Bash auditor; 23 synthetic controls, 17 FAIL→PASS transitions, retained before/after JSON. No live host. | Case |
| Linux access audit with SQL | Linux, SQLite, Python; two permission corrections with actual access retests. | Case |
| Active Directory investigation | Python, Sysmon, Kerberos, PCAP; recorded third-party emulation analysis. | Case |
| Splunk authentication detection | SPL and Python; synthetic fixtures, boundary correction and saved dashboard. | Case |
| Windows process triage | Python, Event 4688; two review candidates and benign controls in synthetic data. | Case |
| Network packet analysis | Python and PCAP; generated 20-frame DNS/HTTP fixture and source-linked findings. | Case |
| Web attack-log analysis and hardening | Python and HTTP; loopback requests, retained logs and remediation retest. | Case |
| Phishing email investigation | RFC 5322, Python; lab-created message, header checks and safe indicator extraction. | Case |
| Enterprise account investigation | Python and CSV; fabricated sign-in and privilege-change timeline with alternative explanations. | Case |
| Forensic evidence examination | Python and hashes; generated evidence package, working-copy examination and artifact citations. E3 classroom experience is separately described. | Case |
| Project | Implementation and status | Portfolio |
|---|---|---|
| SOC Triage Assistant | Runnable Python CLI, synthetic inputs, actual HTML/JSON output and focused tests. | Case |
| Firewall Policy Reviewer | Original offline Python CLI for bounded IPv4 iptables-save input: CIDRs and closed destination-port ranges, single/combined shadowing and partial-overlap checks. Reproducible synthetic JSON/HTML/CSV evidence; no live firewall access. |
Visual case · RDP walkthrough · Port-range HTML artifact · CSV · Execution record |
| Splunk execution workflow | Separate live synthetic replay confirmed 70 indexed events, five original findings and one native tracked alert. Bundled app installation and dashboard rendering remain unverified. | Source-bound record · Analyst case |
| Certification learning engines | Public Security+ source and SC-900 source remain in their existing repositories. | Case |
| AWS IAM Policy Reviewer | Original offline Python checks for literal broad IAM Allow statements, wildcard role assumption, and mixed action lists. Reproducible synthetic before/after reports; no AWS credentials or effective-permission claim. | Visual case · Role-assumption case study · Code, reports and scope |
| Project | Available material and scope | Portfolio |
|---|---|---|
| Network intrusion investigation | Résumé lab account covering Kali, Wireshark and Snort; original session evidence is not included. | Case |
| Offensive security VM training | Owner-confirmed Kali, VMware, Necromancer and HackThisSite practice; defensive takeaways and evidence limits. | Case |
| Kali VM and network visibility | Prior lab experience connected to separately identified public packet-analysis artifacts. | Case |
| Splunk threat investigation playbook | Illustrative SPL searches and analyst questions for authentication, execution and persistence. | Case |
| Project | Public material | Portfolio |
|---|---|---|
| Celestial Resonance | Architecture summary of private research engineering; private implementation is excluded. | Case |
| Research AI Infrastructure | Architecture summary of private evidence-aware research software; private implementation is excluded. | Case |
The original tools are written by the authors named below. The collection's work is the pinned import, controlled examples, execution runner and source-linked results. Full author and license details.
| Integration example | Original tool and authors | Collection contribution and result |
|---|---|---|
| SSH algorithm review | ssh-audit — Joe Testa and contributors · MIT | Two-algorithm fixture, offline runner and retained upstream classifications. No server scan claimed. |
| Secret detection | Yelp/detect-secrets · Apache-2.0 | Three-file fixture, before/after runner, benign/allowlist controls and recorded outputs; network verification disabled. |
| Synthetic Linux access hardening | AngelaMos/CarterPerez-dev Linux CIS auditor · AGPL-3.0-or-later | Controlled section-5 test roots, 17 FAIL→PASS transitions, saved JSON and rerunnable verifier; not a real-host CIS claim. |
These are runnable third-party CLI imports, not projects written for this portfolio. Only the Linux CIS auditor has a recorded synthetic section-5 fixture run; the other six have no collection execution results. No real-host security outcome is claimed for any of these copies. Their original AGPL-3.0-or-later license and source credit are preserved.
| Copied tool | Original authors and purpose | Open source |
|---|---|---|
| HTTP security-header scanner | ©AngelaMos / CarterPerez-dev; evaluates HTTP response security headers | Code, usage and limitations |
| Hash identifier | ©AngelaMos / CarterPerez-dev; suggests likely hash formats | Code, usage and limitations |
| Linux CIS hardening auditor | ©AngelaMos / CarterPerez-dev; Linux hardening checks and compliance scores | Synthetic lab evidence · Source and run limits |
| DLP scanner | ©AngelaMos / CarterPerez-dev; checks for sensitive data in files, databases and PCAPs | Source and run limits |
| DNS lookup CLI | ©AngelaMos / CarterPerez-dev; DNS, reverse lookup and WHOIS investigation | Source and run limits |
| Docker Security Auditor | ©AngelaMos / CarterPerez-dev; assesses Docker configurations and CIS-style controls | Source and run limits |
| SBOM Vulnerability Matcher | ©AngelaMos / CarterPerez-dev; maps software dependencies and queries vulnerability data | Source and run limits |
The pinned files have a separate import manifest, preserving the earlier recorded integrations unchanged.
These are direct, pinned imports from two additional maintainers—not original code or completed hands-on investigations. No network use, runtime validation, or detection findings are claimed.
| Copied source | Original maintainer and purpose | Provenance |
|---|---|---|
| dnstwist | elceef; phishing/lookalike-domain permutation analysis | Pinned source and limitations |
| assetfinder | tomnomnom; public subdomain discovery | Pinned source and limitations |
| httprobe | tomnomnom; HTTP/HTTPS reachability probing | Pinned source and limitations |
Exact file identities are recorded in a separate manifest and checked without running the imported tools.
Python labs use the standard library unless their individual instructions state otherwise. Start with the offline SOC Triage Assistant:
python projects/10-soc-triage/triage.py projects/10-soc-triage/fixtures/authentication.csv projects/10-soc-triage/fixtures/processes.json --output-dir soc-triage-caseUse a new output directory. Open the generated report.html locally. The supplied walkthrough deliberately returns exit code 2 / PARTIAL, retaining rejected rows. Its README explains the input contract and result.
For another project, open its folder and follow its README. Linux permission checks require the environment described in their instructions; Splunk runtime steps require your own authorized instance. Run the focused tests for the project you change.
Project code, fixtures and evidence are maintained here. The portfolio provides the visual case studies and links back to this collection. Study applications retain their existing source repositories; CR and RAI remain private.
The initial import preserves executable and evidence bytes from the portfolio's published source. Import provenance and the file manifest identify that snapshot. Existing results retain their original dates and limits; importing them is not a new experiment.