Evidence room

Exhibit BSecurity monitoring lab

Two small machines, one log pipeline, and the numbers it produced

In plain English: I built a small version of a company’s security monitoring center at home. It collects records of what every device does and flags anything suspicious, so I can test tools before I recommend them to clients.

Collected: live searches over the lab’s SIEM indexHandling: redrawn as sanitized excerptsAddresses and hostnames: withheld on purpose

304,708

events in 24 hours, one index

5

log sources: firewall, DNS, proxy, containers, host agents

~3,700

host-based detection alerts over 7 days

2

Proxmox VE nodes, deliberately unclustered

Why it exists

Before I recommend SIEM, host-based detection or monitoring tooling to a Cyntraix client, I run it here. Scheduled searches produce a daily digest and a critical-event watch under a search-only service account that can read one index and nothing else.

What it caught

A VPN container that had never worked, crash-looping more than 12,000 times and writing about 361 GB to disk. It is gone now, and so is its agent.

Full lab write-up

Exhibit CBreakwater, doctoral coursework

Evidence-bounded vulnerability intelligence for a simulated OT/IoT network

In plain English: for my doctorate I built software that finds the devices on a simulated network of cameras, routers and other connected equipment, looks up their known security flaws, and ranks which ones to fix first. It only counts what it can prove.

Course: SEAS 8414, Analytical Tools for Cyber, George Washington UniversityNetwork: simulated containers onlySubnet: withheld even though it is fake

C.1 Discovery ledger: what was declared, what answered

248

NVD CVEs matched: 60 critical, 76 high, 107 medium, 5 low

19

default-credential findings, proven on the simulation only

The seven misses are the ceiling for every later phase: no amount of triage can assess a device that never answered, so the report names them instead of scoping them out.

C.2 Evidence graph and fused triage

In plain English: the flaw that sounds worst is not always the most urgent. Ranking by how likely attackers are to actually use a flaw changes the order. Press the two buttons to watch the list re-sort.

Breakwater in full

Exhibit ESoftware I built

Six builds, each with the security design written down before the code

In plain English: software I wrote, with one safety feature in each that you could check.

Client engagements are not listed. Repositories that hold private data or move money stay private; for those, the case studies describe the design instead of linking code. Case studies

Exhibit FThe written record