SECURING
SYSTEMS.
SUPPORTING
PEOPLE.

Designed and implemented a Splunk Enterprise Security (ES) SIEM for a fictional 200-bed hospital with no prior centralized monitoring, onboarding 47 log sources — 312 endpoints, 28 servers, 6 firewalls, Active Directory, and the EHR system — ingesting roughly 80–100 GB/day. Built and tuned detection rules mapped to MITRE ATT&CK, raising technique coverage from an effective 0% baseline to 83% of the priority techniques identified in CISA healthcare advisories. Validated the deployment with Atomic Red Team across five attack scenarios — phishing credential theft, ransomware lateral movement, insider PHI access, brute-force auth, and C2 beaconing — all detected within the required 5-minute window, then tuned the false-positive rate down to 7.2% and cut average investigation time from 4–6 hours to 30–45 minutes. Authored three governance policies (SIEM Acceptable Use, Incident Response, Audit Log Retention) aligned to the HIPAA Security Rule and NIST SP 800-61, moving the org’s NIST CSF Detect maturity from Partial to Risk Informed.

A multithreaded Python tool that logs keyboard input and captures periodic screenshots, demonstrating offensive security concepts including process automation, email-based data exfiltration, and multithreading. Built for educational/red-team research purposes.