I keep 200+ people working, and I find out what happened when something goes wrong.

Context

Multi-office organization with 200+ on-site and remote users on Microsoft 365. A user entered credentials after a phishing email.

Objective

Stop the attacker's access quickly, find out everything the compromised account touched, and leave a clear record for management.

Approach

1. Detected the compromise and confirmed it from sign-in activity in Entra ID.
2. Contained and remediated the account using Entra ID and Microsoft Defender.
3. Investigated the full scope of the compromise in Office 365 with Microsoft Purview eDiscovery.
4. Acted on the findings, then wrote the incident response report with the evidence collected and every action taken.

Result

Account contained and remediated, scope established from evidence, and a written incident report delivered.

Details sanitized. No client data, names, or indicators are shown.

Context

A Windows domain had endpoint logging but no visibility into network traffic.

Objective

Detect suspicious traffic and endpoint behavior and review both in a single console.

Approach

1. Ran the Wazuh manager and Suricata together on one Linux server.
2. Configured port mirroring (SPAN) on a UniFi switch to send a copy of traffic to Suricata.
3. Deployed Sysmon and the Wazuh agent to Windows endpoints through Group Policy.
4. Built and tested it in a test domain first, then rolled it out to a production Windows domain.

Result

Suricata network alerts and Sysmon endpoint telemetry land in the same Wazuh console, with agents deployed domain-wide by GPO.

What I learned

A NIDS sensor only sees what the switch sends it; port mirroring is the piece that makes network detection possible without inline hardware.

Context

A Windows domain environment needed hardening, but the raw scan results were too long to act on.

Objective

Give management a prioritized, staged plan instead of a list of failed checks.

Approach

1. Ran a CIS Benchmark SCA scan across the environment.
2. Grouped the findings and sequenced them into a six-stage roadmap aligned to NIST.
3. Delivered the roadmap as a formal Word report.
4. Built a SharePoint Online permission model on AD-synced security groups with a standard naming convention (SG-SP-Site-Folder-Level).

Result

A staged hardening roadmap the organization can execute, plus a permission model that is auditable by group name.

What I learned

Naming conventions are a security control: when the group name states the site, folder, and access level, reviewing access takes minutes.

Context

Supporting 200+ users across several offices made manual account setup and software installs slow and inconsistent.

Objective

Make onboarding, offboarding, and app deployment repeatable.

Approach

1. Wrote PowerShell scripts for user onboarding and offboarding across Active Directory and Microsoft 365.
2. Automated application deployment with PowerShell and NinjaOne RMM.
3. Solved the PowerShell remoting double-hop problem in a domain-wide reinstall by copying the installer into each session with Copy-Item -ToSession.
4. Fixed a GPO logon script that failed under UAC by moving it to a Group Policy Preferences scheduled task running as SYSTEM.

Result

Standardized onboarding, offboarding, and deployments across offices.

What I learned

Logon scripts run as the user, so anything that needs admin rights belongs in a SYSTEM scheduled task, not a user-context script.

Context

A multi-node home lab with servers, clients, and UniFi gear had no central view of health and uptime.

Objective

Monitor every device from one place without sending SNMP credentials in clear text.

Approach

1. Deployed LibreNMS with Docker Compose on Proxmox.
2. Configured SNMPv3 on Proxmox nodes, Linux servers, Windows 11 clients, and UniFi devices.

Result

Central monitoring of the whole lab over authenticated, encrypted SNMP.

What I learned

SNMPv3 adds authentication and encryption that v2c community strings lack, so it is the version to use on any network you care about.