PHILLIP WOODS

CompTIA Security+ and CySA+ certified with strong skills in threat detection and log analysis. Skilled in Splunk and Azure Sentinel, with hands-on experience in network monitoring using Wireshark. Adapts quickly to fast-paced environments, consistently achieving high-quality outcomes.

Threat Intelligence, SIEM Monitoring, Incident Response, Vulnerability Management, Phishing Analysis, Log Analysis.

Cloud Honeypot & SIEM Lab, 

• Deployed Windows 10 honeypot in Azure forwarded logs to Azure Sentinel.
• Executed KQL queries; enriched data with GeoIP watchlist.

Cyber Threat Intelligence (CTI) Lab, 

• Deployed OpenCTI on Docker; automated ingestion with AlienVault OTX.
• Integrated with Splunk; created lookups for malicious IPs, hashes, domains.

Active Directory SOC Automation Lab

• Built AD domain controller with Splunk server.
• Created alerts for anomalous logins; integrated SOAR (Shuffle) to auto-disable compromised accounts.

Network Packet Indexing Lab, 

• Implemented Arkime with Elasticsearch
• Ingested PCAPs
• Enriched traffic with GeoIP and OSINT to detect malicious domains/IPs.