elastic-siem

Full CTI analyst lab and training package — Docker Compose stack (OpenCTI, TheHive, Elastic SIEM) + 8 structured assignments covering reactive, proactive, full-cycle, and adversary emulation methodology.

Local AI-powered security incident triage. Connect it to your SIEM, point it at a local Ollama model, and get instant analysis on every alert — nothing leaves your machine.

4-VM Active Directory lab simulating 7 enterprise attacks with Elastic SIEM detections, KQL rules, and formal SOC investigation reports mapped to MITRE ATT&CK.

Home SOC lab built on Elastic SIEM — detection engineering, KQL threat hunting, alert tuning, and incident investigations using real Windows endpoint telemetry

SOC Lab 12 — Elastic Detection Rules | Configuring and deploying SIEM detection rules in Elastic Security

SOC Lab 13 — Elastic Attack Simulation & Alerting | Simulating SSH brute force attacks and analyzing detection gaps in Elastic SIEM

Hands-on cybersecurity labs focused on penetration testing, attack simulation, and real-world exploitation techniques.

Advanced SOC threat detection lab using Elastic SIEM, Sysmon, and Kali Linux. Simulated real attacks including Nmap reconnaissance, Hydra brute force, and SMB vulnerability scanning. Built 5 custom KQL detection rules generating 213 live alerts with Kibana dashboards for threat visualization.

SOC Internship project at Elevance Skills

SSH detection gap remediation — installed rsyslog, enabled ForwardToSyslog on Kali Linux, confirmed auth.log ingestion into Elastic SIEM, and validated end-to-end SSH brute force alerting with 31 alerts fired

Enterprise network security lab — multi-site Cisco topology, Azure cloud, Windows Server 2022, Elastic SIEM, RBAC & GPO | Centennial College Capstone 2024

Academic GRC case study applying NIST SP 800-30, business impact analysis, and disaster recovery planning to a fictional hospital Elastic SIEM environment.

Research for security teams already running a SIEM and weighing whether to keep operating it in-house or have it managed. Covers the operational load a SIEM creates after deployment, the SIEM vs. managed SIEM decision, provider evaluation criteria, cost models, and rollout.

SOC Lab 14 — Threat Hunting in Kibana | Performing threat hunting queries in Elastic Discover to identify anomalous host behavior

SOC Lab 20 — GRC: Policy and Technical Enforcement | Writing a security policy and demonstrating technical enforcement using Elastic SIEM and Linux system controls

My first hands-on Intel 471 threat hunting workshop experience investigating CVE-2023-46604 using Elastic SIEM, vulnerability intelligence, and post-exploitation detection.

SOC Lab 11 — Elastic SIEM Setup | Deploying Elastic Security and ingesting logs from Kali Linux via Elastic Agent

Tutorial-guided Elastic SIEM home lab using Kali Linux, Elastic Agent, log analysis, dashboards, and a custom detection rule for nmap activity.