Benja User

I designed and implemented a SOC lab with Splunk, Suricata, TheHive, Cortex, and MISP. It reflects my training in Level I security event analysis, alert classification, escalation, incident follow-up, and shift documentation.

For the lab, I developed eight Splunk and Sigma detections mapped to MITRE ATT&CK and assigned severity to support triage. I documented the incident lifecycle in TheHive and wrote three incident reports.

I also wrote five response playbooks with escalation criteria based on severity, along with an analyst operations manual. My certifications include TryHackMe Security Analyst Level 1 (SAL1) and Cyber Security 101 (SEC1).

On Log Sentinel, I built a browser-based log analyzer that detects brute force, suspicious access, and port scans, with six Level I triage training scenarios. I also developed Kali MCP, a Python server that lets an AI agent operate a Kali VM with token authentication, command allowlisting, and audit logging.