Skip to content
View numanshaik-security's full-sized avatar
💭
Final semester Cybersecurity MSc | CompTIA Security+ |🔍Open to SOC Analyst roles
💭
Final semester Cybersecurity MSc | CompTIA Security+ |🔍Open to SOC Analyst roles

Block or report numanshaik-security

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Maximum 250 characters. Please don't include any personal information such as legal names or email addresses. Markdown supported. This note will be visible to only you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
numanshaik-security/README.md

Hey, I’m Numan 👋

I’m a final-semester Cybersecurity M.S. student based in Houston, working toward a career as a SOC Analyst or Detection Engineer.
I enjoy building small, focused labs that answer practical questions like “who scanned me?” and “what did they try?”

🔧 What I’m working on

  • Windows Security Monitoring (Splunk) – tracking failed logons (4625), account lockouts, and brute-force attempts
  • Snort → Splunk Portscan – detecting Nmap SYN bursts and visualizing top sources/ports with timelines
  • OWASP ZAP – Juice Shop Assessment – web application vulnerability scanning and reporting

🎯 Why I build these labs

I learn best by simulating real-world scenarios, collecting raw logs, and transforming them into fields, searches, and dashboards that speed up investigation and triage.

🛠️ Skills & Tools

  • SIEM: Splunk (SPL queries, dashboards)
  • Threat Detection: Windows Event Logs, Snort, OWASP ZAP
  • Networking & Testing: Nmap, Wireshark basics
  • Platforms: VirtualBox, Docker, Ubuntu, Kali Linux
  • Scripting: Basic Python
  • Certification: CompTIA Security+

📂 Projects

  • Windows Security Monitoring (Splunk SIEM)
    Repo: Splunk-security-dashboard
    Focus: Event IDs 4625/4624/4740, brute-force logic, lockout tracking

  • Snort → Splunk Portscan Demo
    Repo: snort-splunk-portscan-demo
    Focus: SYN-burst detection, field parsing, top sources/ports, time-based visualization

  • OWASP ZAP – Juice Shop Lab
    Repo: owasp-zap-juice-shop-lab
    Focus: OWASP Top 10 vulnerabilities, scanning methodology, HTML reporting

🚀 What’s next

  • Expand Splunk dashboards with Sysmon (process/network visibility)
  • Experiment with slow-scan detection and GeoIP enrichment
  • Document additional labs for SOC triage and incident response practice

🤝 Connect with me

Pinned Loading

  1. Splunk-security-dashboard Splunk-security-dashboard Public

    Windows Security Monitoring Dashboard in Splunk – detect failed logons, track account lockouts, and visualize authentication trends.

  2. snort-splunk-portscan-demo snort-splunk-portscan-demo Public

    Snort → Splunk home-lab that detects Nmap portscans and visualizes alerts (top sources/ports, timeline, last 50). Includes SPL & helper scripts

    Shell 1

  3. owasp-zap-juice-shop-lab owasp-zap-juice-shop-lab Public

    OWASP ZAP Scan on OWASP Juice Shop application

    HTML 1