{"id":29006550,"url":"https://github.com/stevehoober254/cybersecurity-portfolio","last_synced_at":"2026-02-03T17:40:17.750Z","repository":{"id":287216147,"uuid":"963972035","full_name":"stevehoober254/cybersecurity-portfolio","owner":"stevehoober254","description":"🔐 Threat detection, Sigma rules, SIEM dashboards \u0026 automated incident response pipelines","archived":false,"fork":false,"pushed_at":"2025-04-16T14:58:02.000Z","size":12,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-06-25T16:50:40.420Z","etag":null,"topics":["blue-team","cybersecurity","detections","incident-response","malware-analysis","sigma","soar","splunk","threat-hunting"],"latest_commit_sha":null,"homepage":"","language":"Zeek","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/stevehoober254.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2025-04-10T13:48:44.000Z","updated_at":"2025-04-16T14:58:05.000Z","dependencies_parsed_at":"2025-04-12T04:30:32.946Z","dependency_job_id":null,"html_url":"https://github.com/stevehoober254/cybersecurity-portfolio","commit_stats":null,"previous_names":["stevehoober254/cybersecurity-portfolio"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/stevehoober254/cybersecurity-portfolio","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stevehoober254%2Fcybersecurity-portfolio","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stevehoober254%2Fcybersecurity-portfolio/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stevehoober254%2Fcybersecurity-portfolio/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stevehoober254%2Fcybersecurity-portfolio/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/stevehoober254","download_url":"https://codeload.github.com/stevehoober254/cybersecurity-portfolio/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stevehoober254%2Fcybersecurity-portfolio/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29051113,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-03T15:43:47.601Z","status":"ssl_error","status_checked_at":"2026-02-03T15:43:46.709Z","response_time":96,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["blue-team","cybersecurity","detections","incident-response","malware-analysis","sigma","soar","splunk","threat-hunting"],"created_at":"2025-06-25T12:38:23.954Z","updated_at":"2026-02-03T17:40:17.675Z","avatar_url":"https://github.com/stevehoober254.png","language":"Zeek","funding_links":[],"categories":[],"sub_categories":[],"readme":"# 🛡️ Cybersecurity Engineer Portfolio\n\nA showcase of blue-team engineering projects covering detection engineering, incident response, and threat intelligence automation. This repo contains Sigma rules, SOAR scripts, and log analysis workflows for real-world security ops.\n\n## 🔍 Highlights\n- Sigma rule writing \u0026 validation\n- Automated SOAR playbooks\n- Log parsing and threat hunting\n- Secret scanning \u0026 malware analysis\n- Incident response reporting templates\n\n## Project List\n\n## 1. Enterprise SOC Simulator\n[View Project](./soc-simulator)\n\n### Problem\nMost security analysts lack realistic labs to practice incident detection and response.\n\n### Solution\nCreate a SOC-in-a-box simulation environment using:\n- **Zeek** and **Suricata** for network telemetry\n- **Wazuh** for host-based monitoring\n- **Filebeat + Logstash + Elasticsearch + Kibana (ELK)**\n- Attack simulation via **Atomic Red Team**\n\n### Goals\n- Simulate insider and external threats\n- Build dashboards for alert investigation\n- Integrate with Sigma rules and MITRE ATT\u0026CK\n\n### Screenshots\n![SOC Dashboard](./screenshots/soc-simulator/dashboard.png)\n![Alert Investigation](./screenshots/soc-simulator/investigation.png)\n![Threat Hunting](./screenshots/soc-simulator/hunting.png)\n\n---\n\n## 2. Phishing Detection Proxy\n[View Project](./phishing-proxy)\n\n### Problem\nOrganizations struggle to protect users from newly launched phishing sites.\n\n### Solution\nIntercept and analyze user HTTP traffic using:\n- **Squid proxy server**\n- **Real-time URL analysis API** (e.g., VirusTotal, PhishTank)\n- **Python backend** for decision making\n- Alerting via **Slack** or **email**\n\n### Goals\n- Block or warn users visiting dangerous domains\n- Log all phishing attempts with metadata\n- Provide daily phishing attempt summaries\n\n### Screenshots\n![Proxy Dashboard](./screenshots/phishing-proxy/dashboard.png)\n![Phishing Alert](./screenshots/phishing-proxy/alert.png)\n![Analytics Report](./screenshots/phishing-proxy/analytics.png)\n\n---\n\n## 3. GitHub Secret Scanner and Revoker\n[View Project](./secret-scanner)\n\n### Problem\nDevelopers accidentally commit secrets (API keys, tokens) to public repositories.\n\n### Solution\nBuild a GitHub Actions-based scanner:\n- Uses **truffleHog** or custom regex patterns\n- Automatically revokes credentials via API (e.g., AWS, GCP, Stripe)\n- Sends report to **Slack** or **email**\n\n### Goals\n- Scan new pushes and PRs for secrets\n- Auto-revoke and notify on detection\n- Generate compliance audit reports\n\n### Screenshots\n![Scan Results](./screenshots/secret-scanner/scan-results.png)\n![Alert Dashboard](./screenshots/secret-scanner/alerts.png)\n![Audit Report](./screenshots/secret-scanner/audit.png)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstevehoober254%2Fcybersecurity-portfolio","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fstevehoober254%2Fcybersecurity-portfolio","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstevehoober254%2Fcybersecurity-portfolio/lists"}