I built and tuned a Wazuh correlation rule that detects SSH brute-force activity in about two seconds, then added an automated response that blocks the attacking host at the firewall. I documented the rule and its results in an open-source GitHub write-up.
In my security labs, I’ve configured Splunk log ingestion and detection rules, deployed Suricata to monitor traffic, and investigated simulated attacks using MITRE ATT&CK. At Endeavor Health, I lead a rehabilitation team and manage confidential records in Epic EHR, maintaining zero errors across HIPAA compliance audits.
