Five hands-on cybersecurity projects, built to demonstrate verifiable, practical SOC skills. Open source (MIT).
Problem: SOC analysts need to know how cloud detections actually fire — not just theory.
What it is: A minimal AWS detection stack (VPC → CloudTrail → S3 → GuardDuty → SecurityHub) deployed with Terraform, three adversary-emulation scenarios using Stratus Red Team (verified technique IDs), a triage guide, and blank incident report templates.
Skills: CloudTrail analysisGuardDuty triageIncident response workflowTerraform IaC
Problem: Tier-1 analysts drown in raw CloudTrail logs; simple heuristics catch the obvious badness fast.
What it is: A working CLI tool that parses CloudTrail JSON, flags anomalous logins / failed-login spikes / risky IAM changes, enriches IPs via AbuseIPDB, and emits a Markdown report. Ships with synthetic sample data and a passing pytest suite.
Skills: Python scriptingLog analysisIOC enrichmentDetection heuristics
▶ Try it live in your browser · → 02-python-ioc-analyzer on GitHub
Problem: Phishing triage is daily Tier-1 SOC work — header forensics, auth-result interpretation, URL deobfuscation.
What it is: A full walkthrough of a reconstructed training-sample phish, a header-analysis cheatsheet, a blank analysis report template, and a self-test guide using GoPhish (own mailbox only).
Skills: Email header forensicsSPF/DKIM/DMARCURL analysisPhishing triage
Problem: Powerful binary-analysis tooling exists, but it isn't human-friendly for quick triage.
What it is: A one-command ELF binary triage CLI (triage.py <binary>): section-entropy packing heuristics, W^X detection, suspicious-import watchlist, string IOC extraction, score-based verdict (benign/suspicious/malicious), and a one-page analyst report. Optional REA provider enrichment; degrades honestly without it.
Skills: Static binary analysisELF internalsMalware triage heuristicsDetection engineering
Problem: Agent skill packs exist for software engineering — nothing in them speaks SOC.
What it is: Five agent skills for the Tier-1 analyst loop, each distilled from a working project in this repo: alert-triage, incident-report, cloudtrail-ioc, phishing-analysis, binary-triage. Each skill declares its trigger, workflow, output contract, and honesty boundaries. MIT licensed, copy-paste installable into any agent's skills directory.
Skills: Detection triageIncident documentationKnowledge distillation