$ whoami → Aspiring Junior SOC Analyst
Ayoub Ahmed_
I watch the alerts, separate signal from noise, and document what happened so the next analyst doesn't start from zero.
// analyst on duty
How I work an alert
01 Triage: is it real?
02 Investigate: what touched what?
03 Escalate or close, with reasons
04 Document for the next shift
About
I got into cybersecurity through my IT support experience and hands-on security labs, where I developed an interest in defensive security and threat detection. I currently focus on Linux, SIEM monitoring, log analysis, and security research while building practical home-lab projects. I'm working toward a career as a Junior SOC Analyst.
Labs: TryHackMe, CyberDefenders, and hands-on Wazuh SOC labs.
Skills
Detection & triage
Log analysis, Windows Event ID 4625, Wazuh SIEM
Web defense
WAF deployment, reverse proxy, network segmentation, MITRE ATT&CK mapping
OWASP Top 10
Web attack testing and detection: SQL injection, XSS (DVWA)
Tooling
Wazuh, SafeLine, Kali Linux, Hydra, DVWA, Docker, KVM/QEMU
Projects
Home lab · SIEM
Wazuh Home Lab: RDP Brute-Force Detection
Simulated RDP brute-force attacks (Kali/Hydra) against a Windows 10 endpoint, detected and correlated in Wazuh, with Windows Event ID 4625 mapped to MITRE ATT&CK T1110.
Home lab · WAF
SafeLine WAF Lab
SafeLine reverse-proxy WAF in front of DVWA, tested from Kali with SQL injection and XSS payloads. Attacks were detected, blocked and logged.