Projects & Labs

Practical evidence of continuous cybersecurity learning.

These projects show hands-on growth across SOC monitoring, Active Directory, vulnerability management, network defense, malware analysis, and troubleshooting in unfamiliar situations.

Cybersecurity home lab workstation with multiple monitoring dashboards

Featured Home Labs

Blue Team / Splunk / Active Directory

Enterprise Active Directory + SIEM Home Lab

Built an on-premises virtual SOC lab using VMware Workstation, pfSense, Windows Server Active Directory, domain-joined clients, and Splunk to practice centralized logging and Blue-Team monitoring workflows.

  • Designed a controlled network with pfSense as the gateway and Active Directory DNS as the authoritative internal DNS service.
  • Forwarded and reviewed endpoint and server activity to support centralized log visibility and security investigation practice.
  • Documented the lab architecture, screenshots, and analyst learning outcomes for portfolio evidence.
View repository

Active Directory / Help Desk / System Administration

Windows Server 2025 Active Directory Lab Series

Completed a continuous nine-part Windows Server 2025 lab covering virtual infrastructure preparation, AD DS deployment, DNS, domain joins, Sysmon monitoring, user administration, Group Policy, network shares, desktop standardization, and Chrome Enterprise deployment.

  • Prepared Windows Server and Windows 11 client systems for a domain-based lab environment.
  • Created users, groups, OUs, and GPOs while practicing common help desk and system administration tasks.
  • Troubleshot a failed software deployment and identified permissions as the cause, showing practical problem-solving during an unfamiliar issue.
Start series Final exercise

SIEM / XDR / SOC Workflow

Wazuh SIEM/XDR Homelab

Deployed a Wazuh SIEM/XDR lab to simulate SOC visibility, endpoint monitoring, alert review, and defensive security workflows in a controlled environment.

  • Practiced end-to-end SIEM deployment concepts using open-source security tooling.
  • Connected monitoring concepts with firewall, IDS, syslog, and endpoint visibility.
  • Built familiarity with alert-driven investigation workflows used in security operations.
View repository

Vulnerability Management

Nessus, OpenVAS, Remediation, and Verification Workflow

Performed a multi-stage vulnerability management workflow using Nessus Essentials and OpenVAS, then documented remediation and verification through follow-up scanning.

  • Ran vulnerability assessments, reviewed severity, and interpreted risk using CVSS and public vulnerability context.
  • Compared Nessus and OpenVAS results to understand detection coverage, reporting differences, and tool selection tradeoffs.
  • Validated remediation by rescanning a Windows Server host after applying recommended fixes.
Nessus OpenVAS Remediation

Network Defense / Firewall

pfBlocker-NG Deployment on pfSense

Configured pfBlocker-NG on pfSense to practice DNS filtering, IP reputation blocking, GeoIP restrictions, threat feed use, and log-based validation in a home lab network.

  • Implemented perimeter control concepts using free and open-source firewall tooling.
  • Tested blocking behavior and reviewed logs to confirm whether policy decisions worked as expected.
  • Connected firewall configuration decisions to Blue-Team monitoring and network defense goals.
View repository

IDS / Packet Analysis

Snort IDS with pfSense and Wireshark

Created and tested Snort IDS rules within pfSense while using Wireshark to observe traffic and support event correlation during controlled lab simulations.

  • Practiced IDS rule deployment, traffic monitoring, and packet-level validation.
  • Used Wireshark to connect network packets with alert behavior for investigation context.
  • Documented methodology for controlled testing instead of relying only on tool output.
View repository

Threat Intelligence / Malware Analysis

Suspicious Executable Investigation

Investigated a suspicious executable in a controlled lab using Sysmon telemetry, VirusTotal, Joe Sandbox, and Wireshark traffic capture to compare static, reputation, behavioral, and network indicators.

  • Documented findings with clear scope limits, confidence levels, and educational-lab context.
  • Compared VirusTotal and Joe Sandbox results to understand why low detection rates do not always mean low investigation value.
  • Practiced analyst-style reporting by separating observed evidence from inference.
VirusTotal Joe Sandbox Comparison

Network Fundamentals

TCP Three-Way Handshake Analysis

Explained the TCP three-way handshake beyond memorized SYN, SYN-ACK, and ACK terminology by focusing on sequence number synchronization, port readiness, and reliable session establishment.

  • Connected protocol behavior to practical troubleshooting and traffic analysis.
  • Created supporting documentation and video content to reinforce technical communication skills.
View repository

Linux Administration

Ubuntu Server Account Recovery Lab

Recovered access to an Ubuntu Server lab system by using GRUB recovery options, identifying the correct local user account, and resetting credentials from a recovery environment.

  • Practiced Linux recovery workflows in a controlled virtual machine.
  • Documented each step to show troubleshooting logic when credentials or account details are unknown.
View repository

Security Baselines / Governance

CIS Controls and Benchmarks Study

Studied the difference between CIS Controls as strategic security guidance and CIS Benchmarks as technical hardening baselines for configuring systems securely.

  • Built foundational understanding of how frameworks guide security programs and benchmarks support secure configuration.
  • Connected baseline hardening concepts to Windows Server and Blue-Team defensive practices.
View repository