Esmail Nouralden

Built a hands-on Wazuh SIEM investigation lab to detect and analyze SSH brute-force activity using Linux authentication logs and endpoint telemetry. Correlated failed SSH login attempts with Wazuh alerts to identify the attacker source IP, targeted accounts, MITRE ATT&CK T1110/T1110.001 mapping, and confirmed that no successful authentication occurred.

Ingested and correlated Windows, Linux, and Suricata logs in Splunk; validated alerts, analyzed PCAP traffic, identified IOCs mapped to MITRE ATT&CK.

Built a hands-on IBM QRadar SIEM lab and configured Linux and Windows log ingestion. Integrated Linux logs using rsyslog over Syslog and Windows Event Logs using IBM WinCollect. Validated event ingestion through Log Activity, tcpdump, and AQL searches. Created custom DSM parsing, regex-based custom properties, and QID mappings for authentication, privilege escalation, user creation, and command execution events.

Automated infrastructure security and Linux administration by building a centralized bot with role-based access control and audit logging, enabling BMC credential rotation through Redfish APIs across Dell iDRAC, HP iLO, and Lenovo XClarity Controller (XCC), SSH-based IP configuration, cloud-init network lockdown, and server-to-server rsync transfers, while also performing subnet sweeps and full-port scans to discover SSH services on non-standard ports and correlate them against an Excel-backed asset inventory.

Built an AI-based stolen car detection system in Python/C paired with real-time alerting.