Sourabh Mane

Attacking my own EC2 instance, then catching it in CloudTrail, VPC Flow Logs and Splunk.

A Free Tier SOC lab on AWS. I exposed a Linux EC2 instance, simulated SSH brute-force and port-scanning against it, and traced the activity through VPC Flow Logs and CloudTrail. CloudTrail API activity and EC2 system logs were ingested into Splunk Free, where I wrote SPL searches and dashboards for failed authentication and unusual behaviour, then closed the exposure in the security group.

• Simulated SSH brute-force and reconnaissance against resources I own
• VPC Flow Logs showed repeated inbound SSH from a single external IP
• CloudTrail confirmed no authentication attempt succeeded
• CloudTrail and EC2 logs ingested into Splunk Free with custom SPL dashboards

A Flask dashboard that reads Wireshark exports and flags port scans, DoS-like volume and odd ports.

Packet Sentinel takes a Wireshark CSV export and turns it into a traffic summary with security alerts. It counts packets and unique hosts, charts the top talkers and protocols, and runs three detection rules over the capture: port scanning, possible DoS volume, and traffic on non-standard ports.

• Upload a Wireshark CSV export (capped at 10 MB)
• Summary: total packets, unique source and destination IPs
• Top 5 source IPs and protocol distribution charts
• Port-scan, possible-DoS and unusual-port alerts

SPL searches and an alert for brute-force logins and malware events, worked through the IR lifecycle.

An internship task in Splunk Cloud. I built a sample security log dataset of failed and successful logins, brute-force attempts and malware detections, uploaded it, and wrote SPL to surface the patterns. The brute-force search became an alert, and the write-up follows the incident from detection through recovery.

• Custom CSV dataset: logins, brute-force attempts, Trojan / worm / ransomware detections
• SPL to find more than 5 failed logins per user and source IP
• SPL to group malware detections by source, signature and severity
• “Brute Force Login Alert” saved from SPL, with trigger conditions and actions

Live ICMP latency collection, Isolation Forest anomaly detection, and an LLM-written engineering review.

A three-stage Python pipeline. It pings the default gateway, public DNS resolvers and a live host to log latency and packet loss, runs an Isolation Forest per target to flag abnormal spikes without fixed thresholds, charts the results, and sends the summary to Llama 3.3 70B via Groq for a prioritised troubleshooting review.

• Collects latency and packet loss from gateway, Google and Cloudflare DNS, and a live host
• Unsupervised anomaly detection per target with Isolation Forest
• Latency-over-time chart with anomalies highlighted
• LLM review that references the data and lists prioritised actions