Core Stack :
I’m Omar, an early-career SOC analyst and cybersecurity student focused on defensive security, cloud security, detection engineering, and incident response. This repository documents structured, hands-on work across the Blue Team skill stack: alert triage, log analysis, SIEM investigations, endpoint telemetry, automation, threat hunting, and security monitoring.
Every project here is built to reflect real SOC workflows rather than simple tutorial replays. These are lab environments, and where a project has limitations, its README explains them clearly. The goal is to demonstrate practical competence: alerts I have investigated, detections and workflows I have built, incidents I have analyzed from start to finish, and security tools I can confidently discuss
The detection, triage, and incident response work most representative of day-to-day SOC and detection engineering operations.
| Project | Focus | Techniques |
|---|---|---|
| Blue Team SOC Lab | Log Ingestion, Log Pipeline | T1059.001, T1059, T1543 |
| SOAR Integrated DFIR Stack | Alert Level Flagging and Ticket/Case Creation | Multi-Technique |
| Project | Focus |
|---|---|
| Bash IP Sweep Port Scanner | Ping Sweeps and Scans Ports within a Network |
- CompTIA Security+
- CISCO CCNA
- Writing up detection scenarios (MITRE ATT&CK mapped) from the lab
> Status
Building. Learning. Documenting. Improving.