All Work
007 ProjectsHome lab builds, detection write-ups, and incident-response exercises, filterable by category.
001 — blue team / soc / detection engineering
$ systemctl status wazuh-manager
● wazuh-manager.service — Wazuh Manager
Active: active (running) since 2026-10-14 07:55:01 UTC
Main PID: 1234 (wazuh-manager)
$ tail -f /var/ossec/logs/alerts/alerts.json
{"timestamp":"2026-10-14T08:12:03.217Z",
"rule":{"id":100002,"level":10,"description":
"SSH brute force (multiple non-existent users)"},
"agent":{"name":"endpoint-linux","ip":"192.168.56.106"},
"data":{"srcip":"192.168.56.102","dstport":"22"},
"MITRE":{"tactic":"Credential Access","id":"T1110.001"}}
⚡ active-response: firewall-drop.sh triggered
iptables -I INPUT -s 192.168.56.102 -j DROP
[+] Block applied TTL: 600s auto-unblock scheduled
✓ Rule 100002 freq=5 tf=120s 37.5% faster than #5712
✓ 6/6 alerts verified across 30 attack runs (100%)
Blue Team / SOC / Detection Engineering2026
Wazuh SIEM: Log Analysis & Detection Engineering
Enterprise Wazuh SIEM deployment with custom SSH brute-force correlation rules, alert tuning, and automated iptables active response.
002 — blue team / siem / infrastructure
Splunk Enterprise 10.4.2 | 192.168.56.108:8000
Universal Forwarder → port 9997 STATUS: RECEIVING
index=main sourcetype=linux_secure earliest=-1h
| rex "Failed password for (?<user>\S+) from (?<src>\S+)"
| stats count by src, user | sort -count
src user count status
────────────────────────────────────────────
192.168.56.102 root 42 FAILED
192.168.56.102 admin 28 FAILED
192.168.56.102 endpoint 14 FAILED
192.168.56.102 pi 7 FAILED
index=main sourcetype=WinEventLog:Security EventCode=4625
→ 156 Windows login failures host: windows-endpoint
✓ Dual-SIEM pipeline: Linux (.106) + Windows (.109)
✓ Forwarder uptime: 99.8% last event: 0.3s ago
Blue Team / SIEM / Infrastructure2026
Splunk Enterprise: SIEM Log Collection & Detection
Enterprise SIEM lab built on Splunk Enterprise 10.4.2 in VirtualBox featuring Universal Forwarder telemetry collection, dual-SIEM co-location alongside Wazuh, and network interface triage.
003 — blue team / siem deployment / intrusion detection
Elastic Stack 8.x | Fleet Server: 192.168.56.105:8220
Agents enrolled: endpoint-linux-waz-plunk, windows-10
Kibana › Security › Detection Rules
[ENABLED] SSH Brute Force severity: HIGH hits: 39
[ENABLED] RDP Auth Failures severity: MED hits: 26
KQL query (Discovery — last 24h)
event.category:"authentication" and event.outcome:"failure"
source.ip event.action count risk
──────────────────────────────────────────────────
192.168.56.102 ssh_login_failed 39 HIGH
192.168.56.102 rdp_auth_failed 26 MED
MITRE T1110.001 Credential Access ← mapped
✓ Fleet routing verified on Host-only 192.168.56.x
✓ Nuance resolved: event.action vs event.outcome
Blue Team / SIEM Deployment / Intrusion Detection2026
Elastic Stack: SIEM Deployment & Intrusion Detection
Enterprise Elastic Stack 9.5.5 SIEM home lab with Fleet Server, dual-endpoint Elastic Agents, KQL threat hunting, and automated MITRE-mapped detection rules for SSH and RDP brute force.
004 — blue team / linux hardening / security auditing
root@ubuntu-hardening:~# ./cis_audit.sh --level 1
[*] CIS Benchmark v8 Ubuntu 24.04 | 96 controls
Category A — Filesystem Partitions
[PASS] 1.1.2 /tmp separate partition (/dev/sda3)
[PASS] 1.1.3 /tmp noexec,nosuid,nodev (fstab ✓)
[PASS] 1.1.7 /var separate partition (/dev/sda4)
[PASS] 1.1.11 /var/log separate mount (/dev/sda5)
Category E — SSH Server Configuration
[FAIL] 5.2.2 PermitRootLogin = yes (expected: no)
[FAIL] 5.2.3 PasswordAuthentication = yes (expected: no)
[PASS] 5.2.9 MaxAuthTries = 3 (≤ 4 ✓)
[*] T1105 payload staging in /tmp blocked by noexec
[*] Remediation script generated for 2 failing controls
Summary: 21 functions | 6 categories | 96 controls
✓ Baseline snapshot saved: fresh-install-before-hardening
Blue Team / Linux Hardening / Security Auditing2026
Linux Server Hardening & CIS Security Audit
Enterprise Linux defense-in-depth hardening on Ubuntu Server 24.04 LTS based on CIS Benchmark standards, featuring dedicated FHS filesystem partitioning and automated Bash compliance audit tooling.
005 — blue team / soc / incident response
# playbook-bruteforce.yml (NIST IR Lifecycle)
incident_id: IR-2026-001 severity: HIGH
status: CONTAINED analyst: aufaanggara
DETECTION
source: Wazuh rule 100002 level: 10
alert: SSH brute force attacker: 192.168.56.102
tool: Hydra (-t 16) target: endpoint-linux :22
CONTAINMENT — AUTO
active-response: firewall-drop TTL: 600s
iptables DROP 192.168.56.102 [applied ✓]
CONTAINMENT — MANUAL
account 'endpoint' revoked session killed [done ✓]
suricata rule SID 9000001 — web attack detection
Scenario 2: SQLi + Webshell RCE DVWA + Metasploitable2
Playbooks: 2 YAML | Writeups: 9 docs | Scenarios: 2/3
✓ NIST Lifecycle: Contain → Eradicate → Recover DONE
Blue Team / SOC / Incident Response2026
Incident Response Playbooks: Multi-Scenario Lab
End-to-end NIST Incident Response lifecycle execution across SSH brute force and web application attacks combining Wazuh EDR, Suricata NIDS, and structured YAML playbooks.
006 — blue team / vulnerability management / full-stack security
POST /api/v1/findings HTTP/1.1
Authorization: Bearer sanctum|token_valid
Content-Type: application/json
HTTP/1.1 201 Created (Laravel 11 + MySQL 8.0)
{
"id": 42, "title": "SQL Injection in /search",
"severity": "CRITICAL", "cvss": 9.8,
"cwe": "CWE-89", "status": "Open",
"assigned_to": "pentester", "client": "Acme Corp",
"pdf_report": "/exports/findings-42.pdf"
}
GET /api/v1/dashboard/stats
total: 5 critical: 1 high: 2 medium: 2
remediation_rate: 60% templates: CWE-89, 79, 639
Roles: pentester / manager / client (RBAC ✓)
✓ 11 core features | 10 REST endpoints | PDF export
Blue Team / Vulnerability Management / Full-Stack Security2026
Vulnerability Management & Remediation Platform
Full-stack vulnerability lifecycle tracking and remediation platform built with Laravel Sanctum REST APIs, dynamic JSON category schemas, Docker MySQL, and interactive React analytics.
007 — offensive security / reconnaissance automation
$ python orchestrator.py --domain tesla.com
[*] Starting automated reconnaissance pipeline ...
Phase 1 ▸ Subfinder (crt.sh + passive OSINT)
[+] 917 subdomains discovered (tesla.com)
Phase 2 ▸ HTTPX — live host probing
[+] 195 / 917 hosts alive (HTTP 200/301/403)
[-] 722 unreachable (timeout / NXDOMAIN)
Phase 3 ▸ Nmap -F --open (top-100 ports)
[+] avg scan time: 2.5s/host (DNS → 8.8.8.8 fix)
[!] 80,443,22,8443 open on 47 targets
Phase 4 ▸ WHOIS metadata (parallel workers=8)
[+] registrant, ASN, expiry captured for all live
Rate limit: 3 req/min/IP (HTTP 429 guard active)
Results stored → SQLite | API: FastAPI :8000
✓ Pipeline complete | slowapi | domain regex valid
Offensive Security / Reconnaissance Automation2026
Automated Reconnaissance Pipeline & Web UI
End-to-end attack surface discovery platform chaining Subfinder, HTTPX, Nmap, and WHOIS through a FastAPI backend with SQLite persistence and an interactive React dashboard.