Blue Team • SOC • Detection Engineering

Nour Maghalawy

SOC Analyst focused on threat detection, incident response, SIEM monitoring, and detection engineering. I build practical blue-team labs across Windows security, Active Directory, IDS/IPS, deception, and behavior-based analytics.

Splunk Elastic / ELK Wazuh Snort Active Directory Windows Security Logs

View Projects GitHub LinkedIn

Primary Focus

SOC / Blue Team

Hands-on detection labs, technical documentation, and investigation-driven security work.

Core Stack

SIEM + IDS

Splunk, ELK, Wazuh, Snort, Windows native logging, and Active Directory.

Project Style

Proof of Work

Each repository includes readable documentation, practical steps, and project structure.

Current Direction

Detection Engineering

Behavior-based detections, event analysis, deception concepts, and response-minded design.

Featured Projects

Selected blue-team projects and labs that reflect practical detection, monitoring, hardening, and security engineering work.

Blue Team Lab Active Directory

Active Directory Security Hardening Lab

Implemented user-level hardening in a Windows Server domain environment using Group Policy, privilege restrictions, and centralized policy enforcement.

Windows Server AD DS GPO Endpoint Hardening

Network Security Lab Snort IDS / IPS

Snort IDS / IPS Lab

Deployed Snort in IDS mode and then inline IPS mode using AFPacket, built custom rules, simulated attacks, and validated real-time blocking behavior.

Ubuntu AFPacket hping3 Traffic Filtering

Detection Lab Behavior-Based Detection

Info-Stealer Detection Lab

Built a small detection lab to identify early-stage fileless Info-Stealer behavior using Windows process creation telemetry and SIEM-based behavioral logic.

Event ID 4688 PowerShell Elastic SIEM Process Chaining

Security Research Deception

Early Breach Detection using Deception

Designed a lightweight deception-based detection model that uses canary-style signals and smart containment ideas to expose attacker footholds earlier and with less noise.

MITRE ATT&CK Canary Tokens Lateral Movement Containment

Security Research Lab Adversarial ML / Wazuh SIEM

Adversarial ML Behavior Detection & SIEM Correlation Lab

Simulated adversarial machine learning behavior by generating abnormal ML inference signals, then transformed them into Windows security events and integrated them into Wazuh SIEM. Built custom detection rules and correlation logic to identify suspicious ML-driven behavior and escalate repeated activity into high-severity alerts.

Wazuh SIEM Adversarial ML Detection Engineering Correlation Rules

Tools & Skills

Technologies and focus areas reflected across my labs, projects, and technical write-ups.

SIEM Monitoring Threat Detection Incident Response Detection Engineering Threat Hunting Windows Event Logs Active Directory Snort IDS / IPS Splunk Elastic / ELK Wazuh n8n Linux PowerShell Monitoring Network Security MITRE ATT&CK Digital Forensics Malware Analysis Basics

Blue Team • SOC • Detection Engineering

Nour Maghalawy

SOC Analyst focused on threat detection, incident response, SIEM monitoring, and practical blue-team labs. I document hands-on work across Windows security, Active Directory, IDS/IPS, and behavior-based detection.

Splunk Elastic / ELK Wazuh Snort Active Directory Windows Security Logs

View Projects GitHub LinkedIn

Primary Focus

SOC / Blue Team

Hands-on detection labs, technical documentation, and investigation-driven security work.

Core Stack

SIEM + IDS

Splunk, ELK, Wazuh, Snort, Windows native logging, and Active Directory.

Project Style

Proof of Work

Each repository includes readable documentation, steps, and project structure.

Current Direction

Detection Engineering

Behavior-based detections, event analysis, deception concepts, and response-minded design.

Featured Projects

Selected blue-team projects and labs that reflect practical detection, monitoring, hardening, and security engineering work.

Blue Team Lab Active Directory

Active Directory Security Hardening Lab

Implemented user-level hardening in a Windows Server domain environment using Group Policy, privilege restrictions, and centralized policy enforcement.

Windows Server AD DS GPO Endpoint Hardening

Network Security Lab Snort IDS / IPS

Snort IDS / IPS Lab

Deployed Snort in IDS mode and then inline IPS mode using AFPacket, built custom rules, simulated attacks, and validated real-time blocking behavior.

Ubuntu AFPacket hping3 Traffic Filtering

Detection Lab Behavior-Based Detection

Info-Stealer Detection Lab

Built a small detection lab to identify early-stage fileless Info-Stealer behavior using Windows process creation telemetry and SIEM-based behavioral logic.

Event ID 4688 PowerShell Elastic SIEM Process Chaining

Security Research Deception

Early Breach Detection using Deception

Designed a lightweight deception-based detection model that uses canary-style signals and smart containment ideas to expose attacker footholds earlier and with less noise.

MITRE ATT&CK Canary Tokens Lateral Movement Containment

Security Research Lab Adversarial ML / Wazuh SIEM

Adversarial ML Behavior Detection & SIEM Correlation Lab

Simulated adversarial machine learning behavior by generating abnormal ML inference signals, then converted them into security events and integrated them into Wazuh SIEM. Built custom detection rules and correlation logic to identify potential adversarial attacks and improve detection visibility across the environment.

Wazuh SIEM Adversarial ML Detection Engineering Threat Detection

Tools & Skills

Technologies and focus areas reflected across my labs, projects, and technical write-ups.