cyberskope_
./work./agent./detection./lab./journey./skills./terminal./contact

Security Engineer · Germany

Signal over noise.

Four years engineering and operating a multi-tenant Wazuh SIEM estate for banking, insurance and public-sector customers. Everything as code, every alert with a reason.

▋
See the work Open the terminal
alerts.live — simulated
    0+
    years in security engineering
    ✓
    ✓
    ✓
    ✓
    ✓
    ✓
    ✓
    0
    repositories put under CI
    0
    Wazuh upgrade rounds shipped
    0+
    log source types onboarded
    ◆ Palo Alto◆ F5 BIG-IP◆ IIS◆ nginx◆ fail2ban◆ PostgreSQL◆ pgBackRest◆ MariaDB◆ Postfix◆ Jenkins◆ Tailscale◆ Rundeck◆ Cohesity◆ OpenVPN◆ Akamai◆ GitHub◆ Kubernetes audit◆ RKE2 / Rancher◆ ESET PROTECT◆ Azure◆ Sysmon◆ Defender◆ PowerShell◆ auditd◆ Passwork◆ Palo Alto◆ F5 BIG-IP◆ IIS◆ nginx◆ fail2ban◆ PostgreSQL◆ pgBackRest◆ MariaDB◆ Postfix◆ Jenkins◆ Tailscale◆ Rundeck◆ Cohesity◆ OpenVPN◆ Akamai◆ GitHub◆ Kubernetes audit◆ RKE2 / Rancher◆ ESET PROTECT◆ Azure◆ Sysmon◆ Defender◆ PowerShell◆ auditd◆ Passwork

    Millionsofeventsaday.Ahandfulthatmatter.Ibuildthesystemsthattellthemapart,andproveitwithevidence.

    01 · selected work

    Case studies

    Customer names withheld. Numbers are real.

    02 · agentic AI

    An AI analyst that can't make things up

    Design for an on-prem agent that does the daily SOC review across a multi-tenant SIEM estate. Deterministic where it must be exact, an LLM only where judgement helps.

    step 1 / 6

    Collect

    Code aggregates 24h of alerts per instance and diffs against a Git-reviewed baseline and last week.

    ✓ Read-only

    wazuh:read scope end to end; credentials never leave the proxy.

    ✓ Injection-aware

    Every log field is treated as untrusted input to the model.

    ✓ Shadow mode

    Runs beside the human dailies until it misses no High finding.

    five scenarios · you make the analyst calls · synthetic data

    03 · detection engineering

    Tuning with evidence

    Noise has a root cause. Each case below started with an alert queue nobody trusted and ended with a measured, reviewed change.

    A firmware updater flooding a mount-syscall rule

    194 → 12
    alerts per hour
    problem

    An auditd mount use case was firing around 194 times an hour and burying analysts.

    finding

    Tracing the process lineage showed fwupd, the firmware update daemon, behind the storm.

    fix

    Scoped the benign updater out of the rule and sent the RCA to the customer.

    04 · lab

    Tools that run in your browser

    Small detection-engineering tools I built. Nothing is uploaded; each one says what it can't do.

    01

    Rule translator

    Sigma → Splunk, Elastic, Sentinel, LogScale, Wazuh

    open in lab
    02

    Alert-noise analyser

    Find what floods the queue, draft a reviewed suppression

    open in lab
    03

    ATT&CK coverage

    Map a rule pack's tags onto the ATT&CK matrix

    open in lab
    04

    Decoder & rule tester

    A browser take on wazuh-logtest

    open in lab
    05

    Log field extractor

    auditd, syslog, CEF, LEEF, Windows XML → fields

    open in lab
    06

    Regex portability

    One pattern across PCRE2, OS_Regex, Splunk and KQL

    open in lab
    07

    IOC extractor

    Refang, extract, de-duplicate, defang

    open in lab
    08

    Find the intrusion

    A detection challenge scored on precision and recall

    open in lab
    open the lab

    05 · journey

    Four years, five phases

      • → Greenfield production SIEMs built from scratch on OpenStack with Terraform + Ansible
      • → auditd use-case programme with evidence-based false-positive reduction
      • → Designed an on-prem AI agent that automates the daily SOC review across every SIEM instance

    06 · toolbox

    What I work with

    Wazuh 4.8–4.14OpenSearchCustom decoders & rulesSigmaFIM / SCASysmon & Windows eventsAbuseIPDB / VirusTotal

    07 · shell

    Prefer a terminal?

    Everything on this site is reachable from here. Tab completes, arrows walk history.

    guest@cyberskope:~
    $ help
    navigation
  ls                    list sections, case studies and tools
  open <section>        scroll to a section (work, agent, detection, lab, journey, skills, terminal, contact)
  cat <case>            print a case study (see: ls cases)
  lab [tool]            open the lab, optionally at a tool
  hunt                  start the detection challenge
  sim [scenario]        replay the agent run (incident, quiet, outage, injection, budget)
info
  whoami  stack  projects  agent  stats  contact
shell
  theme dark|light  history  echo <text>  clear
tab completes · ↑ ↓ walk history
    $

    08 · contact

    Let's talk

    Roles in detection engineering, SIEM platform work or security automation.

    cyberskope.eu · built with Next.js · read-only by design
    cyberskope_
    • [ ok ]mounting read-only session
    • [ ok ]loading decoders and rules
    • [ ok ]diffing against baseline
    • [ ok ]agent ready · no external calls