Python framework querying AbuseIPDB, VirusTotal, and AlienVault OTX to automate IOC enrichment and risk scoring. Generates structured JSON threat reports for SOC workflows — cutting manual lookup time from minutes per IOC to seconds, with automated severity classification across all three feeds.

Full Security Operations Center on a Raspberry Pi. Suricata IDS with the Emerging Threats ruleset feeds into Splunk SIEM for real-time detection, alert correlation, and custom dashboard visualization. Rule tuning — suppressing noisy scanner signatures and home-network baseline traffic — dropped alert volume from ~120 to ~72 daily alerts over a 3-week cycle (~40% reduction). This lab produced a real documented detection: a PowerShell-based fileless attack caught and contained in 42 minutes — see the IR writeup below.

A live detection from my Mini-SOC: Wazuh flagged a Base64-encoded PowerShell command (severity 12) on WIN-LAB-01 attempting a remote stage-2 payload download and scheduled-task persistence. I cross-correlated Wazuh HIDS alerts, Suricata network events, and Sysmon endpoint logs in Splunk, then enriched the C2 IP 185.220.101.42 via my Threat Intel Bot — 100/100 AbuseIPDB, 8/92 VirusTotal flags. Detection to containment: 42 minutes. Host isolated, process terminated, malicious scheduled task removed, forensic artifacts preserved.

Pi-hole DNS sinkhole blocking ads and malicious domains across the entire home network. Custom blocklists, regex filtering, and whitelist management. Blocks ~15,000 domains/day with full query logging and per-client visibility.

Three-VLAN segmented lab (LAN / OPT1 / OPT2) with full LAN/WAN separation, per-segment DHCP and DNS, explicit inter-VLAN firewall rules, NAT, and OpenVPN client + site-to-site VPN. Suricata running in inline IDS mode across all interfaces — actively caught and logged intrusion attempts during red team exercises. Default-deny between segments, tuned ruleset, forensic alert review.