Bogdan Drabchuk

I’m a Security Engineer focused on Elastic Stack SIEM—bridging cluster architecture, data lifecycle (ILM/SLM), and practical ingestion for real-world logs. I’ve administered production Elasticsearch clusters and tuned settings like index templates, shard allocation, snapshot repositories, and logsdb mode to improve storage efficiency and reliability.

I integrate complex enterprise log ecosystems by building custom ingest pipelines and Grok patterns to normalize non-standard log sources. In practice, I’ve connected 10+ log sources (including Fortinet, Palo Alto, Cisco, CrowdStrike, Microsoft Defender for Endpoint, and others) using Logstash and Elastic Agent, so detections work across multiple vendors with consistent ECS alignment.

I also deploy and scale security tooling with Elastic Agent and Elastic Defend, configuring Fleet security policies and contributing to Ansible-based mass rollout. Alongside my engineering work, I actively run bug bounty activities and have confirmed, paid findings at High/Medium severity—fueling my mindset for threat-driven tuning and continuous improvement as I grow further into DevSecOps.