incident-detection

Autonomous agent for Kubernetes incident detection, diagnosis, and mitigation using LLMs and modular workflows. Integrates LangChain, LangGraph, and MCP servers to enable automated SRE tasks in cloud-native environments.

An Advanced Incident Detection System! I've developed a comprehensive security monitoring application that uses computer vision and AI to detect various security incidents in real-time, including falls, intrusions, loitering, and abandoned objects.

Splunk lab detecting SSH brute-force attacks using failed login events, alerts, and dashboards.

This project demonstrates SSH authentication log analysis using Splunk SIEM to detect malicious activity such as brute-force attacks, unauthorized access attempts, and suspicious SSH behavior. It simulates real-world SOC analyst workflows, including log ingestion, SPL queries, dashboards, and alerting.

Security Automation with Python A real-time log monitoring and alerting system built with Python. This project automates log parsing, anomaly detection, IP enrichment (via ipinfo.io), and Slack-based alerting. It includes a live Streamlit dashboard and a watchdog-based monitor to simulate a lightweight SIEM pipeline — ideal for SOC Tier 1/2 work

Real-Time Road Incident/Hazard Detection and SMS Alert System using OpenCV/YOLO, T5 string generation, Twilio SMS API

Real-time highway incident detection using YOLO for traffic monitoring and safety

When an incident gets reported, TAP finds the nearest cameras, grabs a live frame, and asks AI whether it can actually see what's happening — then saves the whole thing as a record you can browse.

Watch rotating logs, match significant events, suppress repeats, and send restrained alerts.

Turns surveillance footage into reviewable incidents, not frame noise. Browser samples frames, a vision model reads them, temporal aggregation merges them with an evidence chain. Web app and drone agent share one contract.

Home-lab SOC project demonstrating layered defense: a pfSense perimeter firewall and a Wazuh SIEM/XDR endpoint agent on separate VMs, with a simulated external attack (Nmap recon, Hydra SSH brute-force) correlated across both firewall logs and endpoint FIM/authentication alerts.

Lightweight log ingestion and real-time incident detection engine in Go

Does a Jev-labelled support-tweet stream spike before a brand admits an outage? At equal false alarms it catches 17 vs 10 incidents (volume), ~4h ahead; a good keyword list is almost as good.

This project demonstrates how to ingest, parse, and analyze DNS logs using Splunk Enterprise. By leveraging Zeek-style JSON DNS logs, we perform meaningful security and traffic analysis using Splunk Search Processing Language (SPL).

A new package that processes news headlines or short text inputs to generate structured summaries of events, such as service disruptions or incidents. It uses an LLM to extract key details like the co

Cloud-native purple team lab: Entra ID attacks (consent abuse, password spray) detected with custom KQL in Microsoft Sentinel and mitigated, mapped to MITRE ATT&CK.

Python security tool for parsing authentication logs and detecting suspicious SSH login activity.

BeCode AD lab on Azure : build, harden, detect. 11 MITRE techniques, 11/11 detection rate. External credential-stuffing capture as real-world validation.

Threat detection lab simulating security monitoring in Linux environments using log analysis, detection rules and correlation between authentication, system and resource events.

Intentionally vulnerable PHP login app paired with a custom Wazuh SIEM detection pipeline for SQL injection — from exploit discovery to detection engineering to remediation, documented end-to-end including the infrastructure debugging along the way.