Anton avulman

Hi, I'm Anton! 👋

A detection engineering platform that treats detections like software: version-controlled, tested, and automatically deployed through GitHub Actions.

Simulated five-system enterprise environment with Active Directory, Sysmon, Splunk, and Security Onion
Every detection is validated before deployment: JSON event injection for Splunk, PCAP replay for Suricata, and fixture evaluation for Sigma
Deploys via REST API and Playwright UI automation, with coverage mapped to MITRE ATT&CK

Python GitHub Actions Splunk Sigma Suricata Zeek Security Onion Active Directory

End-to-end automation for user-reported phishing in Microsoft 365.

Ingests reported emails through Microsoft Graph and extracts IOCs
Enriches with VirusTotal and AbuseIPDB, then calculates a threat risk score
Hunts across mailboxes for other impacted users and opens a ServiceNow incident automatically

Python Azure Microsoft Graph API Microsoft 365 ServiceNow VirusTotal AbuseIPDB Linux

Multi-VM Active Directory environment with centralized logging and endpoint telemetry.

Splunk SIEM with Sysmon across Windows 10, Windows Server, Ubuntu Server, and Kali Linux
Simulated brute force attacks with Crowbar and traced the activity in Splunk
Validated detection coverage with Atomic Red Team against MITRE ATT&CK techniques

Splunk Sysmon Active Directory Atomic Red Team VirtualBox

In progress: GIAC Certified Forensic Analyst (GCFA, SANS FOR508)