Projects
siem-lab
Wazuh and Suricata in Docker with custom rules mapped to MITRE ATT&CK, replayed against public EVTX attack samples and a generated pcap. No custom rule fired at first; after I fixed the decoder routing, every rule with a test event fired. 24 pytest checks pass.
- Wazuh
- Suricata
- Docker
- pytest
detection-rules-as-code
10 Sigma rules, each with true- and false-positive sample events, a linter and a CI gate. All 10 convert to Splunk SPL. A deliberate bad edit to one rule turned CI red.
- Sigma
- pySigma
- Splunk SPL
- GitHub Actions
soc-honeypot-lab
Honeypot log lab with Sentinel-style detections written as KQL, Sigma and Python that run locally, scored against labelled synthetic events. The README documents the misses and the blind spots.
- Python
- KQL
- Sigma
- pytest
phishdesk-in
Explains why an .eml looks like phishing: header authentication checks plus Indian bank and UPI lure rules, tested on 69 synthetic lab emails.
- Python
- stdlib email
soar-mini
IOC enrichment playbook: refangs indicators, queries VirusTotal, AbuseIPDB and URLhaus (mocked offline), scores them and asks a human before any block. Verdicts match my labels on 6 synthetic alerts.
- Python
- YAML playbooks
More on GitHub
evtx-triage · pcap-hunter · ioc-aggregator · ssh-threat-feed · l1-copilot
Skills
- SIEM and IDS: Wazuh, Suricata, Splunk SPL, Sigma and pySigma, KQL basics
- Investigation: Windows event logs (EVTX, Sysmon), Linux auth logs, MITRE ATT&CK mapping, phishing header analysis (SPF, DKIM, DMARC), IOC enrichment
- Tooling: Python, Bash, pytest, GitHub Actions, Docker
2025 B.E. Information Technology, Sinhgad Institute of Technology & Science (SPPU), Pune, with Honours in Cybersecurity.
Experience
CTF Player and Security Researcher · Hack The Box and TryHackMe
Work through Linux and Windows boxes on Hack The Box and TryHackMe, including Active Directory attacks, which shows me what the logs look like from the attacker's side. I write step-by-step reports for each. Placed 13th in the CloudSEK CTF (Aug 2025).
- Active Directory
- Nmap
- Reporting
ServiceNow System Administrator, Virtual Intern · AICTE program
Built ITSM reports and dashboards from incident and problem records, and completed labs on incident and problem management, the work an L1 desk does every shift.
- ServiceNow
- Incident management
Certifications
Certified Ethical Hacker (CEH) Practical
EC-Council · Credential ID ECC9356741028
arcX Foundation Threat Intelligence Analyst
arcX
Microsoft Azure Fundamentals (AZ-900)
Microsoft
Other roles: Cloud security & DevSecOps · DevOps / SRE / NOC · AI security · VAPT & AppSec · Software & QA · Security (SOC, VAPT and AI security) · Writing