M Falah Aufa A
Yogyakarta, Indonesia
SOC Analyst Enthusiast — Yogyakarta, Indonesia

M Falah Aufa A

IT undergraduate turning log noise into signal, defending systems one alert at a time.

Available for work
My Resume
Scroll

01 — Selected Work

001 — blue team / soc / detection engineering
$ systemctl status wazuh-manager
● wazuh-manager.service — Wazuh Manager
Active: active (running) since 2026-10-14 07:55:01 UTC
Main PID: 1234 (wazuh-manager)
 
$ tail -f /var/ossec/logs/alerts/alerts.json
{"timestamp":"2026-10-14T08:12:03.217Z",
"rule":{"id":100002,"level":10,"description":
"SSH brute force (multiple non-existent users)"},
"agent":{"name":"endpoint-linux","ip":"192.168.56.106"},
"data":{"srcip":"192.168.56.102","dstport":"22"},
"MITRE":{"tactic":"Credential Access","id":"T1110.001"}}
 
⚡ active-response: firewall-drop.sh triggered
iptables -I INPUT -s 192.168.56.102 -j DROP
[+] Block applied TTL: 600s auto-unblock scheduled
 
✓ Rule 100002 freq=5 tf=120s 37.5% faster than #5712
✓ 6/6 alerts verified across 30 attack runs (100%)
001 / Blue Team / SOC / Detection Engineering

Wazuh SIEM: Log Analysis & Detection Engineering

2026
002 — blue team / siem / infrastructure
Splunk Enterprise 10.4.2 | 192.168.56.108:8000
Universal Forwarder → port 9997 STATUS: RECEIVING
 
index=main sourcetype=linux_secure earliest=-1h
| rex "Failed password for (?<user>\S+) from (?<src>\S+)"
| stats count by src, user | sort -count
 
src user count status
────────────────────────────────────────────
192.168.56.102 root 42 FAILED
192.168.56.102 admin 28 FAILED
192.168.56.102 endpoint 14 FAILED
192.168.56.102 pi 7 FAILED
 
index=main sourcetype=WinEventLog:Security EventCode=4625
→ 156 Windows login failures host: windows-endpoint
 
✓ Dual-SIEM pipeline: Linux (.106) + Windows (.109)
✓ Forwarder uptime: 99.8% last event: 0.3s ago
002 / Blue Team / SIEM / Infrastructure

Splunk Enterprise: SIEM Log Collection & Detection

2026
003 — blue team / siem deployment / intrusion detection
Elastic Stack 8.x | Fleet Server: 192.168.56.105:8220
Agents enrolled: endpoint-linux-waz-plunk, windows-10
 
Kibana › Security › Detection Rules
[ENABLED] SSH Brute Force severity: HIGH hits: 39
[ENABLED] RDP Auth Failures severity: MED hits: 26
 
KQL query (Discovery — last 24h)
event.category:"authentication" and event.outcome:"failure"
 
source.ip event.action count risk
──────────────────────────────────────────────────
192.168.56.102 ssh_login_failed 39 HIGH
192.168.56.102 rdp_auth_failed 26 MED
 
MITRE T1110.001 Credential Access ← mapped
 
✓ Fleet routing verified on Host-only 192.168.56.x
✓ Nuance resolved: event.action vs event.outcome
003 / Blue Team / SIEM Deployment / Intrusion Detection

Elastic Stack: SIEM Deployment & Intrusion Detection

2026
004 — blue team / linux hardening / security auditing
root@ubuntu-hardening:~# ./cis_audit.sh --level 1
[*] CIS Benchmark v8 Ubuntu 24.04 | 96 controls
 
Category A — Filesystem Partitions
[PASS] 1.1.2 /tmp separate partition (/dev/sda3)
[PASS] 1.1.3 /tmp noexec,nosuid,nodev (fstab ✓)
[PASS] 1.1.7 /var separate partition (/dev/sda4)
[PASS] 1.1.11 /var/log separate mount (/dev/sda5)
 
Category E — SSH Server Configuration
[FAIL] 5.2.2 PermitRootLogin = yes (expected: no)
[FAIL] 5.2.3 PasswordAuthentication = yes (expected: no)
[PASS] 5.2.9 MaxAuthTries = 3 (≤ 4 ✓)
 
[*] T1105 payload staging in /tmp blocked by noexec
[*] Remediation script generated for 2 failing controls
 
Summary: 21 functions | 6 categories | 96 controls
✓ Baseline snapshot saved: fresh-install-before-hardening
004 / Blue Team / Linux Hardening / Security Auditing

Linux Server Hardening & CIS Security Audit

2026
005 — blue team / soc / incident response
# playbook-bruteforce.yml (NIST IR Lifecycle)
incident_id: IR-2026-001 severity: HIGH
status: CONTAINED analyst: aufaanggara
 
DETECTION
source: Wazuh rule 100002 level: 10
alert: SSH brute force attacker: 192.168.56.102
tool: Hydra (-t 16) target: endpoint-linux :22
 
CONTAINMENT — AUTO
active-response: firewall-drop TTL: 600s
iptables DROP 192.168.56.102 [applied ✓]
CONTAINMENT — MANUAL
account 'endpoint' revoked session killed [done ✓]
 
suricata rule SID 9000001 — web attack detection
Scenario 2: SQLi + Webshell RCE DVWA + Metasploitable2
 
Playbooks: 2 YAML | Writeups: 9 docs | Scenarios: 2/3
✓ NIST Lifecycle: Contain → Eradicate → Recover DONE
005 / Blue Team / SOC / Incident Response

Incident Response Playbooks: Multi-Scenario Lab

2026

That’s the reel for now. More shipped work is available on request.

View all work→

02 — About

I’m Muhammad Falah Aufa Anggara, an Information Technology undergraduate at Universitas Gadjah Mada (Faculty of Engineering), and my focus is on the defensive side of security, specifically SOC analysis: watching logs, triaging alerts, and figuring out what’s actually a threat versus what’s just noise.

I like systems I can reason about end to end, which is part of why I’m drawn to SOC work: it rewards patience, pattern recognition, and knowing your environment well enough to notice when something’s off. Outside of coursework, I’m usually digging into SIEM tooling, working through CTF challenges, or reading up on threat detection techniques.

Muhammad Falah Aufa Anggara — SOC Analyst Enthusiast

Arsenal

001siem

SIEM & Log Management

Aggregation, correlation, and alerting

WazuhElastic / KibanaSplunk EnterpriseMicrosoft Sentinel
002network

Network Analysis

Traffic capture, protocol inspection, anomaly detection

WiresharkZeektcpdumpNetworkMiner
003endpoint

Endpoint & Telemetry

Host-level visibility and threat detection

SysmonVelociraptorosqueryWindows Event Logs
004threat-intel

Threat Intelligence

IOC enrichment and adversary tracking

MITRE ATT&CKVirusTotalAbuseIPDBAlienVault OTX
005forensics

Digital Forensics

Memory, disk, and artifact analysis

VolatilityAutopsyFTK ImagerKAPE
006scripting

Scripting & Automation

Custom tooling and query languages

PythonBashPowerShellKQL / SPL
007frameworks

Frameworks & Methodology

Standards guiding detection and response

NIST 800-61MITRE ATT&CKCIS BenchmarksSigma Rules
008vuln-mgmt

Vulnerability Management

Scanning, prioritization, and attack surface reduction

NmapSubfinder / HTTPXOpenVASNessus
SIEM ·Threat Detection ·Log Analysis ·Incident Response ·Wireshark ·Linux ·Network Security ·Python ·Next.js ·TypeScript ·Git ·Blue Teaming ·SIEM ·Threat Detection ·Log Analysis ·Incident Response ·Wireshark ·Linux ·Network Security ·Python ·Next.js ·TypeScript ·Git ·Blue Teaming ·

By The Numbers

Quantifiable experience across defensive and offensive cyber ranges.

03 — Experience

Focusing on the fundamentals of computer science, software engineering, information systems, and network technologies.

Computer ScienceSoftware EngineeringNetworking

Working through structured SOC analyst training focusing on alert triage, log correlation, and incident response workflows using open-source SIEM tooling.

Log AnalysisIncident Response

Developed and optimized motion control algorithms for robots to ensure precise and stable movement during competitions.

RoboticsMotion ControlAlgorithmsC++

04 — Certifications

05 — Write-ups

Investigations, detection engineering notes, and blue-team CTF walkthroughs focused on documenting the thinking process, not just the answers.

⚠

Under Maintenance

Technical write-ups and lab documentation are currently undergoing maintenance and migration. The articles listed below are actively being synchronized with updated formatting, technical analysis, and verified repository links.

06 — Contact

Let'smakesomethingworthstoppingfor.

mfaufalaha@gmail.com
GITHUB ↗LINKEDIN ↗
Available for work