Soc

A bot that intercepts SIEM alerts, auto-enriches them with IP reputation, user activity, and asset ownership, then drops a pre-triaged summary into Slack before a human ever opens the ticket.

A scheduled Python detection that flags accounts hit with 20+ failed logins from rotating IPs in a 5-minute window and auto-opens a Jira ticket for the SOC, turning auth-log noise into something actually actionable.

A pipeline that picks up the emails users report through my Gmail phishing add-on, detonates their URLs in a sandbox, reads the verdict, and auto-quarantines malicious mail before anyone gets a chance to click.

A nightly cron job that pulls control evidence from AWS, Okta, GitHub, CrowdStrike, and Proofpoint into dated, immutable folders in S3 — so audit prep is a download instead of a fire drill.

Learn how to build a Gmail add-on to report phishing emails, automate analysis with AI and ThePhish, and integrate with Jira for streamlined SOC operations.

Learn how to automate Okta log detections using OpenSearch and Python to identify risky activity, reduce noise, and streamline SOC workflows by creating actionable Jira tickets.