Skip to content
View ibu-cyx0's full-sized avatar
🎯
Focusing
🎯
Focusing
6 followers · 4 following

Achievements

Achievement: Pair ExtraordinaireAchievement: Pull SharkAchievement: YOLOAchievement: Quickdraw

Achievements

Achievement: Pair ExtraordinaireAchievement: Pull SharkAchievement: YOLOAchievement: Quickdraw

Block or report ibu-cyx0

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
ibu-cyx0/README.md

ibu-cyx0@github ~ $ ./contributions.sh

IBRAHIM Contribution Heatmap



ibu-cyx0@github ~ $ whoami

Operator Portrait SOC Telemetry & Radar Stats

ibu-cyx0@github ~ $ ./links.sh

Portfolio LinkedIn TryHackMe X Email


cat profile.txt

╔══════════════════════════════════════════════════════════════════════════════╗
║  [+] SOC WORKSTATION // NODE: ibu-cyx0@soc-hq                  [ONLINE ●]    ║
╠══════════════════════════════════════════════════════════════════════════════╣
║  ┌───────────────────────────────────┐  ┌─────────────────────────────────┐  ║
║  │ OPERATOR : Mohamed Ibrahim H      │  │ RANK   : TryHackMe Top 5% (50+) │  ║
║  │ ROLE     : SOC Analyst | Blue Team│  │ STATUS : Actively Hunting       │  ║
║  │ LOCATION : Tamil Nadu, India      │  │ DEGREE : B.E. Cyber Security    │  ║
║  │ FOCUS    : SIEM · CTI · IR · ZTA  │  │ PAPER  : IJARIIT Vol.11 (2025)  │  ║
║  └───────────────────────────────────┘  └─────────────────────────────────┘  ║
╠══════════════════════════════════════════════════════════════════════════════╣
║  [>] EXPERIENCE                                                              ║
║      [✓] SOC Analyst Intern — The Mind IT (Jan–Apr 2026 | Hybrid)            ║
║          • Triaged & correlated security alerts across Splunk & Wazuh SIEM   ║
║          • Investigated IOCs to filter false positives & escalate incidents  ║
║                                                                              ║
║  [>] VERIFIED CERTIFICATIONS & RECOGNITION                                   ║
║      [✓] EC-Council Certified SOC Analyst (CSA)                              ║
║      [✓] EC-Council Ethical Hacking Essentials (EHE)                         ║
║      [✓] Splunk Core Certified User                                          ║
║      [✓] Cisco Certified CyberOps Associate                                  ║
║      [✓] Wazuh Ambassador (Certificate of Recognition)                       ║
║                                                                              ║
║  [>] MISSION : "Defend systems before attackers find the door open."         ║
╚══════════════════════════════════════════════════════════════════════════════╝

cat /etc/skills.conf

🛡️ SIEM, XDR & Threat Defense

Splunk Wazuh Elastic Stack Microsoft Sentinel Microsoft Defender ServiceNow

📡 Network Forensics & Perimeter

Wireshark pfSense Suricata Snort Nmap

┌──────── [ BLUE TEAM READINESS ] ────────┐
│ Security Monitoring  ███████████░  94%  │
│ Threat Detection     ███████████░  92%  │
│ Incident Response    ██████████░░  88%  │
│ Log Correlation      ███████████░  94%  │
│ Threat Intelligence  █████████░░░  85%  │
│ Zero Trust (800-207) █████████░░░  85%  │
└─────────────────────────────────────────┘

💻 Security Automation & Infra

Python Scikit-Learn Bash PowerShell Flask Docker Ansible VirtualBox Git

🧬 Threat Intel & Frameworks

MITRE ATT&CK NIST 800-207 MISP AbuseIPDB

┌──────── [ NETWORK & PROTOCOL ] ─────────┐
│ TCP/IP Stack         ███████████░  92%  │
│ Packet Forensics     ███████████░  92%  │
│ DNS / HTTP / TLS     ███████████░  90%  │
│ Firewall Rule Eng.   ██████████░░  88%  │
│ Active Directory/IAM █████████░░░  82%  │
│ SIEM Rule Authoring  ███████████░  92%  │
└─────────────────────────────────────────┘

ls ~/projects/ --sort=impact

🔥 CTI Automation Platform FLAGSHIP

Automated Cyber Threat Intelligence & Splunk Correlation Pipeline

┌──────────────┐    ┌───────────────┐    ┌───────────────┐
│ OTX/AbuseIPDB├───►│ Python Engine ├───►│ Splunk SIEM   │
│ + URLhaus    │    │ Deduplication │    │ Live Dashboard│
└──────────────┘    └───────────────┘    └───────────────┘
  • Multi-Feed Ingestion: Automated IOC collection across AlienVault OTX, AbuseIPDB & URLhaus via Python REST APIs.
  • Real-Time SIEM Matching: Correlates live IOCs against firewall/proxy logs in Splunk with automated severity tagging (CRITICAL to LOW).

🤖 AI SOC Alert Triage System ML // 0.99 AUC

Machine Learning False-Positive Reduction Engine for Tier-1/Tier-2 SOC

┌──────────────┐    ┌───────────────┐    ┌───────────────┐
│ 2,000 Alerts ├───►│ Random Forest ├───►│ TP ► Tier 2   │
│ 10 Features  │    │ 98.5% Test Acc│    │ FP ► AutoClose│
└──────────────┘    └───────────────┘    └───────────────┘
  • High-Precision Triage: Trained a Random Forest classifier on 2,000 synthetic labeled SOC alerts, achieving 98.5% test accuracy and 0.99 ROC-AUC.
  • Automated Escalation: Scores alert confidence and escalates verified CRITICAL true positives to Tier 2, auto-closing false positives.

🛡️ Zero Trust Network Simulation Lab NIST 800-207

4-Zone Micro-Segmented Architecture & MITRE ATT&CK SIEM Detection

┌──────────────┐    ┌───────────────┐    ┌───────────────┐
│ 4-Zone Net   ├───►│ Python ZTA    ├───►│ Wazuh SIEM    │
│ 13 pfSense   │    │ Policy Engine │    │ 6 ATT&CK Rules│
└──────────────┘    └───────────────┘    └───────────────┘
  • Micro-Segmentation: Engineered SOC / DEV / MGMT / GUEST zones per NIST SP 800-207 with 13 custom pfSense default-deny firewall rules.
  • Continuous Verification: Built a Python Zero Trust Policy Engine (device trust, MFA, role, IP, time) paired with 6 MITRE ATT&CK rules in Wazuh.

🏠 SOC Home Lab & 🌐 Packet Forensics SIEM + PCAP

End-to-End SIEM Correlation & Deep Packet Inspection Workflows

┌──────────────┐    ┌───────────────┐    ┌───────────────┐
│ Wireshark/PCAP├──►│ Scapy / Rules ├───►│ Splunk + Wazuh│
│ DNS/HTTP/TCP │    │ C2 & BruteFrc │    │ IR Playbooks  │
└──────────────┘    └───────────────┘    └───────────────┘
  • SIEM Detection Engineering: Built custom brute-force and anomalous authentication detection rules across Splunk and Wazuh.
  • Protocol Forensics: Captured and dissected live HTTP, DNS, and TCP traffic using Wireshark and Scapy to uncover C2 patterns.

ls -la ~/certifications_and_research/

Credential / Milestone Issuing Body / Venue Domain & Impact
🏆 Certified SOC Analyst (CSA) EC-Council Tier-1/Tier-2 SOC Operations, SIEM & Incident Response
🏆 CyberOps Associate Cisco Network Security Operations & Protocol Forensics
🏆 Core Certified User Splunk SPL Queries, Dashboards & Log Correlation
🏆 Ethical Hacking Essentials (EHE) EC-Council Attack Surface Analysis & Defensive Countermeasures
🏆 Wazuh Ambassador Wazuh Open-Source SIEM / XDR Community Recognition
📄 Published Research (2025) IJARIIT (Vol. 11, Issue 1) "Creating Tailored Detection and Prevention Mechanisms for Targeted Threats"
🎤 Technical Seminar Speaker College Tech Symposium Delivered "AI-Powered Threat Detection in SOC" to 150+ students

cat /var/log/activity.log

[2026] ──► Wazuh Ambassador Certificate of Recognition .................... [ RECOGNIZED ✓ ]
[2026] ──► SOC Analyst Internship — The Mind IT (Splunk & Wazuh) .......... [ COMPLETE   ✓ ]
[2026] ──► Zero Trust Network Lab (NIST SP 800-207 · 13 pfSense Rules) .... [ COMPLETE   ✓ ]
[2026] ──► CTI Automation Platform (OTX + AbuseIPDB + URLhaus) ............ [ COMPLETE   ✓ ]
[2026] ──► AI SOC Alert Triage System (98.5% Acc · 0.99 ROC-AUC) .......... [ COMPLETE   ✓ ]
[2026] ──► TryHackMe Global Ranking: Top 5% (50+ Rooms Completed) ......... [ ACTIVE     ✓ ]
[2026] ──► EC-Council Certified SOC Analyst (CSA) ......................... [ CERTIFIED  ✓ ]
[2026] ──► B.E. Cyber Security — Paavai Engineering College ............... [ COMPLETE   ✓ ]
[2025] ──► Published Threat Detection Research — IJARIIT Vol. 11, Issue 1 . [ PUBLISHED  ✓ ]
[2025] ──► Splunk Core Certified User & Cisco CyberOps Associate .......... [ CERTIFIED  ✓ ]
[2025] ──► SOC Home Lab (Splunk + Wazuh) & Wireshark Traffic Forensics .... [ COMPLETE   ✓ ]


╔═══════════════════════════════════════════════════════╗
║  "Attackers only need to be right once.               ║
║   Defenders need to be right every time."             ║
║                                    — Blue Team Code   ║
╚═══════════════════════════════════════════════════════╝

Pinned Loading

  1. AI-Powered-Threat-Detection-Engine AI-Powered-Threat-Detection-Engine Public

    ML-based SOC alert triage system using Random Forest to auto-classify alerts as True/False Positive — reducing analyst workload with real-time confidence scoring and live dashboard.

    HTML 4

  2. CTI-Automation-Platform CTI-Automation-Platform Public

    Automated Cyber Threat Intelligence pipeline that collects IOCs from AlienVault OTX, AbuseIPDB & URLhaus, correlates them against Splunk logs, and visualizes active threats on a real-time dark-them…

    HTML 3

  3. Zero-Trust-Network-Simulation-Lab Zero-Trust-Network-Simulation-Lab Public

    Zero Trust Network Simulation Lab implementing NIST 800-207 with pfSense micro-segmentation, identity-aware Python policy engine, Wazuh SIEM monitoring, and live ZT dashboard.

    Python 3 1

  4. SOC-Home-Lab SOC-Home-Lab Public

    Forked from mahesw813-MJ/SOC-Home-Lab

    SOC Home Lab using Wazuh, Splunk, Kali Linux and Security Onion for threat detection and incident response

    3