Security tools and investigation

Cybersecurity

My cybersecurity work includes building tools in Python and Terraform. These public project examples let you follow a finding back to the evidence.

Security project notebookRunnable examples · Sample data

Python · Scikit-learn

Which network activity deserves a second look?

Flow windows

Isolation Forest

Review queue

An Isolation Forest learns a baseline from synthetic network windows. Move the alert threshold and see what it catches or misses.

The examples run on generated data or documented fixtures. Their source includes the inputs and tests.

Project source

Each Python or Terraform project includes a README with setup instructions. The browser walkthroughs use the same example data as the downloads.

Python · Scikit-learn

An unusual flow is a lead to investigate. The model does not establish that an attack occurred.

Terraform · GitHub Actions

The workflow checks code before deployment. The public example does not create cloud resources.

Python · STIX / TAXII

The browser uses a fixed sample feed. The Python client can ingest a TAXII collection you configure.

Python · Nmap · NVD

A version match is a candidate finding. Configuration and vendor backports can change whether a host is affected.