FLAGSHIP / PRACTICAL LAB01 / 03
PHILSIEM / PROJECT 01evidence_first = truestatus: documented
PhilSIEM monitoring
A personal OpenCanary honeypot and alerting environment, with a separate proposed v2 architecture documented as a design study.
INDEPENDENT CYBERSECURITY PORTFOLIO
Security is built
on curiosity.
I build practical security labs, investigate suspicious activity and turn technical learning into documented defensive projects.
HONEYPOT ENGINEERING SOC INVESTIGATIONS THREAT DETECTION
PHILSIEM / OPERATIONS VIEWDEMO DATA
Security event overview SIMULATED
EVENTS REVIEWED024illustrative sample
RULE MATCHES006illustrative sample
ACTIVE LABS001project showcase
Event activityDEMONSTRATION
Authentication anomalyFLAGGED
Connection metadata reviewREVIEW
Audit event recordedLOGGED
● LOCAL LAB CONCEPTNO LIVE DATA EXPOSED
FOCUS AREASSECURITY MONITORINGLINUX LABSNETWORK ANALYSISDEFENSIVE RESEARCH
01 / HANDS-ON WORK
Projects built to learn by doing.
Practical work, documented decisions and lessons learned. These are independent learning projects, not commercial security products.
Explore working lab →View proposed architecture →
PROPOSED ARCHITECTURE02 / 03
PHILSIEM / PROJECT 02evidence_first = truestatus: documented
PhilSIEM v2 architecture
A documented network segmentation and centralised monitoring design. Security Onion, Cowrie, Suricata and Zeek are proposed components, not claimed deployments.
SIMULATED INVESTIGATION03 / 03
PHILSIEM / PROJECT 03evidence_first = truestatus: documented
SOC investigations
Walk through evidence-led simulated cases and try a browser-based SSH event triage exercise. Clearly labelled training data, not live incidents.
02 / INVESTIGATION MINDSET
From signal to evidence.
Security operations is not just spotting an alert. It is understanding the context, documenting findings and knowing what the evidence actually supports.
01
Observe
Review alerts, logs and relevant context.
02
Investigate
Identify patterns, scope and potential impact.
03
Document
Separate confirmed facts from hypotheses.
04
Improve
Refine detections and record lessons learned.
Evidence-first approach. Any public case studies will use sanitised lab data or clearly labelled simulations. Sensitive systems, credentials and personal information stay private.
03 / TOOLKIT
Technical foundations.
Tools and subjects explored through practical labs and ongoing study. Familiarity varies by tool; this is not a claim of expert proficiency.
Security operations
Alert triage · Event analysis · Incident documentation · Detection concepts
Network visibility
Wireshark · Nmap · Network protocols · Traffic investigation
Systems & labs
Ubuntu Linux · OpenCanary · Virtual machines · Remote lab access
Continuous learning
Security+ studies · Defensive research · Practical exercises · Technical write-ups
04 / THE PERSON BEHIND THE LAB
Built from curiosity.
Driven by practice.
I'm developing my career in cybersecurity by building hands-on projects, studying security fundamentals and investigating how defensive systems work in practice.
PhilSIEM is where I document that journey: what I built, what I tested, what went wrong and what I learned. The goal is to develop the judgement and technical foundations needed for security operations work.
Currently focused on practical SOC skills and continued cybersecurity learning.
05 / CONNECT
Interested in the work?
Explore the code and project notes on GitHub. More documented investigations and technical write-ups will be added as the portfolio develops.
Portfolio-ready learning evidence: practical lab documentation, proposed architecture, fictional SOC case studies and an interactive training environment.