// portfolio

Labs & projects

Hands-on security projects: each one comes with a write-up, the code and a downloadable bundle so you can rebuild it yourself.

Filter by tool · microsoft-sentinel
.NETASP.NET CoreAWSActive DirectoryAnsibleAtomic Red TeamAzureAzure PolicyBloodHound CECIS BenchmarksCISA KEVCVSSCheckovCodeQLCycloneDXDebianDockerEPSSES|QLElasticsearchGitHub ActionsGreenboneIPsecKQLLocalStackMicrosoft 365Microsoft Entra IDMicrosoft GraphMicrosoft SentinelMinIOMoleculeOPNsenseOWASP ZAPOpenSCAPOpenSSLOpenVASOpenVPNPSScriptAnalyzerPesterPingCastlePostgreSQLPowerShellProwlerProxmoxPythonS3 Object LockSCAP Security GuideSQL ServerSemgrepSigmaSplunk SPLSuricataSysmonT-SQLTerraformTrivyUbuntuUnboundWazuhWindows LAPSZircoliteansible-lintauditdazureadazurermboto3cosigngitleakspgAuditpgcryptopySigmapytestpython-gvmsigma-clitflint
Cloud & Modern Security Advanced

Azure Secure Landing Zone with Terraform

Terraform landing zone for a fictional organisation: Azure Policy guardrails, hub-spoke network with default-deny NSGs and private endpoints, Sentinel with five ATT&CK-mapped detections, report-only Conditional Access and PIM-eligible admins — tested offline in CI.

AzureAzure PolicyCheckovGitHub ActionsKQL
Threat Detection & SIEM Intermediate

Detection-as-Code with Sigma

Fifteen ATT&CK-mapped Sigma rules for Windows, Linux and Azure. Every pull request lints them, converts them to Splunk, Elastic and Sentinel queries, and runs them against positive and negative sample events on two engines (Zircolite and Elasticsearch) before a ruleset lets the change merge.

ES|QLElasticsearchGitHub ActionsKQLMicrosoft Sentinel