Enterprise SOC Homelab & Network Security Architecture
Designed and deployed a segmented enterprise-style SOC lab using pfSense, VLANs,
Cisco switching, Wazuh, and Security Onion. This project established the network,
monitoring, and visibility foundation for the broader SaintValTech environment,
including mirrored traffic inspection, SIEM support, and controlled separation
between lab systems, user traffic, and monitoring infrastructure.
Focus Areas: Network segmentation, pfSense, VLANs, packet visibility, Security Onion, Wazuh, infrastructure design
View Project
Domain Controller Hardening & Hybrid Identity Foundation
Built and hardened a Tier-0 Windows Domain Controller using Kerberos, NTLM, LDAP,
SMB, audit policy, PowerShell logging, and firewall baseline controls, then extended
the identity environment into Microsoft Entra ID using Azure AD Connect and Hybrid Azure AD Join.
Focus Areas: Active Directory, Group Policy, Kerberos hardening, audit logging, hybrid identity, Microsoft Entra ID
View Project
Microsoft Sentinel SOAR Pipeline & Incident Automation
Created and validated an incident-driven Microsoft Sentinel SOAR foundation using Defender
telemetry, NRT analytics rules, automation rules, and Azure Logic Apps. This project verified
the full Microsoft-native path from detection to incident creation and playbook execution.
Focus Areas: Microsoft Sentinel, Defender XDR, analytics rules, Logic Apps, incident automation, SOAR validation
View Project
Defender for Endpoint Onboarding & Connectivity Troubleshooting in a Filtered Enterprise Network
Investigated and resolved a Microsoft Defender for Endpoint connectivity enforcement issue
on a Windows Server Domain Controller inside a filtered network protected by pfBlockerNG.
The work traced the problem to DNSBL-based interference with required Microsoft cloud endpoints
and restored healthy communication through controlled whitelisting and validation.
Focus Areas: Microsoft Defender for Endpoint, DNS troubleshooting, pfBlockerNG, endpoint connectivity, Windows Server validation
View Project
Zero Trust Exposure of TheHive Using Cloudflare Tunnel, Access, and Microsoft Entra ID
Published TheHive securely without opening inbound firewall ports by using Cloudflare Tunnel
and Cloudflare Access backed by Microsoft Entra ID and MFA. This project replaced traditional
port forwarding with a Zero Trust publication model that supported both analyst access and
secure Microsoft Sentinel-to-TheHive workflow integration.
Focus Areas: Cloudflare Tunnel, Cloudflare Access, TheHive, Zero Trust, Microsoft Entra ID, MFA, secure service exposure
View Project
Multi-Source SOAR Integration with Sentinel, Security Onion, Wazuh, Shuffle, TheHive, and Cortex
Designed a multi-source SOAR architecture that routes Microsoft Sentinel incidents and
high-signal network and endpoint detections into TheHive using Azure Logic Apps, Wazuh,
and Shuffle. The project established case-versus-alert routing, deduplication-aware ingestion,
and a modular workflow separating detection, orchestration, enrichment, and case management.
Focus Areas: SOAR, TheHive, Shuffle, Wazuh, Security Onion, Cortex, Logic Apps, case management, multi-source alert routing
View Project