Sujal

Active Directory SOC Lab with Splunk

Detected a simulated RDP brute-force attack via Event IDs 4624/4625

SOC Automation: LimaCharlie EDR + Tines SOAR

Automated alerting and human-approved host isolation, detection to response

Network Traffic Analysis Tool (Python, Scapy)

Detects port scans, C2 beaconing and DNS tunneling in PCAPs