Case study · evidence-linked
Synthetic Linux access-hardening review
Use a credited third-party CIS-style auditor on two fabricated SSH and password-policy roots. See the 17 changed checks, one remaining failure, reproducible JSON and clear limits.
Explore the work.
Find a case study, inspect my tools and workflows, or browse credited third-party source. Each entry identifies its evidence and authorship.
Start with the three featured investigations or follow a role-specific path.
Investigations
Back to categoriesSource-linked analysis, controlled labs and recorded-capture investigations.
Case study · evidence-linked
Linux access audit with SQL
Joined measured file modes to SQL policies, corrected two unsafe permissions and verified access as an unprivileged user. Public read access stayed available.
Case study · evidence-linked
Active Directory attack-chain investigation
Follow distinct-account failures, RC4 service tickets and remote PowerShell across three targets. Compare execution and collection clocks, inspect exact GUID/session joins, and challenge the network corroboration.
Splunk authentication investigation
Investigated two boundary misses and corrected the SPL to include the exact 600-second window. The same synthetic fixture went from 3/5 to 5/5 expected findings.
Supporting views
Case study · evidence-linked
Windows process triage
Reviewed encoded PowerShell and certutil commands, separating two review candidates from benign controls.
Case study · evidence-linked
Network packet analysis
Traced DNS failures and HTTP activity to specific frames in a generated 20-packet capture.
Case study · evidence-linked
Web attack-log & hardening
Sent five real loopback requests, identified three controlled attack patterns, then retained the four-to-zero hardening retest.
Case study · evidence-linked
Phishing email investigation
Checked sender identity, authentication results and link-domain differences in a lab-created message.
Case study · evidence-linked
Enterprise account investigation
Correlated a failure burst, successful sign-in and privilege change while retaining alternative explanations.
Case study · evidence-linked
Forensic evidence examination & E3
Verified working-copy analysis with artifact citations and owner-confirmed Paraben E3 classroom context.
Tools & software
Back to categoriesVerification tooling and study applications, with execution scope stated in each case.
Portfolio-developed tool or workflow
Splunk Authentication Investigation Workflow
Follow a Splunk authentication export through Python validation, detection logic and a source-linked analyst report. The synthetic lab run accepted 70 events and produced six review candidates.
Portfolio-developed tool or workflow
Firewall Policy Reviewer
Inspect CIDR and destination-port-range overlap, plus a proposed RDP source restriction. Open the Python source, separate examples, and saved HTML/JSON/CSV findings.
Portfolio-developed tool or workflow
Splunk execution workflow
Prepare a fresh replay, verify indexed rows and the actual fired-alert job, then generate a traceable analyst handoff.
Portfolio-developed tool or workflow
Certification learning engines
Security+ and SC-900 study applications with adaptive practice, answer explanations, saved progress, and session resume.
Portfolio-developed tool or workflow
AWS IAM Policy Reviewer
Review a fabricated wildcard role-assumption policy and a proposed narrower permission. Open the original Python CLI, documented case, and saved before/after JSON reports.
Third-party source imports
Back to categoriesTools authored by other developers, retained with licenses and attribution. Source-only copies are not my original work or evidence that I operated the tools. Recorded examples for the earlier integrations and the Linux CIS synthetic lab are linked separately. Full provenance and licenses.
Third-party source · credited import
ssh-audit
SSH algorithm auditing tool. A separate offline algorithm-review walkthrough is recorded in the collection.
Third-party source · credited import
detect-secrets
Secret detection tooling. A separate synthetic controls example is documented in the collection.
Third-party source · credited import
HTTP Security-Header Scanner
Checks response security-header configuration. Credited community source copy for code inspection; no run in this collection is claimed.
Third-party source · credited import
Hash Identifier
Inspects hash formats as a security-analysis aid. Credited community source copy; no local findings are claimed.
Third-party source · credited import
Linux CIS Hardening Auditor
Upstream-authored Linux hardening checks. A separate synthetic section-5 before/after lab now records how this imported scanner responds to fabricated SSH and PAM settings.
Third-party source · credited import
DLP Scanner
Examines content for potential sensitive-data exposure. Credited upstream implementation, imported as source only.
Third-party source · credited import
DNS Lookup CLI
Offers command-line DNS lookups for network analysis. Credited community source; no recorded collection scan.
Third-party source · credited import
Docker Security Auditor
Inspects Docker configuration for potential hardening gaps. Imported Go source only; no container assessment results are claimed.
Third-party source · credited import
SBOM Vulnerability Matcher
Supports software-bill-of-materials and vulnerability-matching workflows. Imported Go source only; no collection validation is claimed.
Third-party source · credited import
dnstwist
Original Python CLI for generating and evaluating domain-name lookalikes. Archived for source inspection; no DNS queries or real-target findings were produced.
Third-party source · credited import
assetfinder
Original Go source for discovering publicly indexed subdomains. Imported as third-party code; no discovery run or domain inventory is claimed.
Third-party source · credited import
httprobe
Original Go CLI for checking HTTP and HTTPS reachability. This is a source snapshot only; no builds or network probes were performed.
Training & playbooks
Back to categoriesPrior authorized practice and investigation guides, with their artifact limits retained.
Training or lab evidence
Network intrusion investigation
Kali Linux simulations, Wireshark packet review and Snort detection tuning.
Training or lab evidence
Offensive security VM training
Owner-confirmed Kali, VMware, Necromancer and HackThisSite practice, with explicit evidence limits and defensive takeaways.
Training or lab evidence
Kali VM & network visibility
Completed isolated VM activity connected to Wireshark packet review, Snort tuning and Splunk investigation context.
Training or lab evidence
Splunk threat investigation playbook
Example searches and analyst questions for authentication, execution and persistence.
Research systems
Back to categoriesPublic architecture summaries of private research projects.
Research system · scope disclosed
Celestial Resonance (CR)
Research infrastructure designed to keep experiments repeatable and the evidence behind results traceable.
Research system · scope disclosed
Research AI Infrastructure (RAI)
Research tooling designed to keep source support, conflicting observations, and permission to act distinct.
Employer resources
Choose the view that fits your review.