Dr Rawal

At Eventus Security, I architect and own end-to-end SIEM platforms spanning log ingestion, correlation, alerting, analytics, and enterprise productization. I led the production migration from OpenSearch to ClickHouse, reducing infrastructure costs by more than 70% while improving query performance and scalability.

I build detection logic mapped to MITRE ATT&CK, including aggregation, cross-correlation, APT, malware, and multi-stage attack-chain rules across endpoint, firewall, proxy, WAF, cloud, and network telemetry. I also emulate real-world attacker TTPs in lab environments to validate coverage and turn detection gaps into production-ready rules and SOC response playbooks.

My work includes centralized IOC intelligence, endpoint-based vulnerability management with NVD CVE correlation, contextual alert prioritization, secure rsyslog/RELP/TLS ingestion pipelines, and multi-tenant SIEM architecture. I focus on making security platforms scalable, cost-efficient, and useful for real investigations.