Detection & Response
SOC Home Lab: Azure Honeypots + Sentinel
Three internet-facing honeypots feeding Microsoft Sentinel, used to write and test real detections against real attackers.
- Deployed Windows RDP, Cowrie SSH and Endlessh honeypots with Azure Monitor Agent and custom log tables; captured 1.24M attempts from 75 IPs with zero compromises.
- Wrote 5 KQL analytics rules (password spray, brute-force-then-success) and rebuilt the low-and-slow rule after v1 missed an attacker guessing once every 12 minutes.
- Reconstructed an SSH intrusion chain, mapped 13 ATT&CK techniques, and identified Panchan, Mirai and Bashlite samples by hash.
SentinelKQLAzure MonitorCowrieMITRE ATT&CKD3
SOAR Automation
Sentinel SOAR: Automated Brute-Force Response
A Logic App playbook that enriches Sentinel incidents with threat intel and blocks high-risk IPs automatically.
- Integrated Sentinel, the AbuseIPDB API and the Azure REST API, running under a least-privilege managed identity.
- Cut triage to ~12 seconds (8–18 s) from 10–15 minutes; blocked IPs made zero further attempts.
- Per-IP grouping reduced 65 alerts to 6 incidents, about 91% less noise for analysts.
Logic AppsAbuseIPDBAzure REST APINSGManaged Identity
Data Analysis
HHS Healthcare Breach Analysis
An analysis of every breach reported to HHS OCR, turned into practical guidance for a small clinic.
- Cleaned and analyzed 8,013 breach records (2009–2026) with Python and pandas.
- Showed hacking grew to 81% of breaches by 2025; published an interactive Plotly dashboard.
- Wrote a security-budget memo for a 40-person clinic based on the findings.
PythonpandasPlotlyJupyter
Infrastructure as Code
This Website: Azure + Terraform
The page you're reading is hosted on Azure Storage and deployed entirely with Terraform.
- Storage account hardened with TLS 1.2+, HTTPS only, no anonymous blob access and soft delete.
- GitHub Actions runs fmt, validate and a Checkov security scan on every push, and fails on any unaddressed finding.
- Each accepted risk is documented in code with a written justification.
TerraformAzure StorageGitHub ActionsCheckov