ELIJAH ZION

A cloud-hosted Elastic SOC I built to practice the full detection-to-investigation workflow against live attack telemetry.

RDP attempts

4,558

source IPs

176

failed SSH logins

47,212

indicators published

258

• Stood up an Elastic SIEM (Elasticsearch, Kibana) with Fleet and Elastic Agent, ingesting Sysmon and Windows telemetry from a Windows endpoint.
• Authored brute-force detection rules, built Kibana dashboards, and triaged the resulting alerts end to end.
• Ran a full adversary emulation (Kali attacker, Mythic C2 running the Apollo agent), generating live attack telemetry and mapping the chain to MITRE ATT&CK (e.g. T1110).
• Deployed Elastic Defend (EDR), validated prevention with a malicious-download test, and configured an automated response action.

A Python tool that discovers hosts on an authorized network, audits the reachable Ubuntu hosts against the CIS Benchmark with OpenSCAP, and produces a fleet compliance report with run-over-run drift. Built as audit evidence for a GRC analyst.

• End-to-end pipeline: nmap discovery → classify → SSH reach → OpenSCAP/SSG detection → scan → SQLite persistence → HTML/JSON/CSV report with drift history.
• Wraps OpenSCAP rather than reimplementing checks, so the compliance verdicts stay authoritative and audit-defensible.
• Authorization-gated and non-intrusive: refuses to run without an explicit, signed-off scope, never installs on or modifies the hosts under audit, and files every host into an honest coverage bucket (scanned, unreachable, scanner_absent, …).