lab.uig.me
Hands-on labs
Every skill I learn becomes a Docker lab with automated checks that I can reset and redo. Only labs I have passed are listed.
–labs passed
–latest pass
Source · ./lab CLI in Bash
Estul Lachin
IT support technician moving into security operations · Edmonton, AB
- Four years of freelance IT support for small businesses: remote user support, network troubleshooting, websites and cloud-hosted services
- SOC analyst training: alert triage in Splunk and IBM QRadar, incident reports
- CompTIA Security+
- CompTIA A+
- Google IT Support Professional Certificate
What I build
honeypot.uig.me
Live SSH/Telnet honeypot
A hardened Cowrie honeypot on a VPS. Real attacks are mapped to MITRE ATT&CK, enriched with AbuseIPDB and published hourly without IP addresses, with a report every week. Raw events stream to Microsoft Sentinel every 10 minutes.
–sessions
–unique sources
detections.uig.me
Detection-as-code
Sigma rules for the attacks the honeypot sees, each tested against attack and look-alike events in CI, converted to Splunk SPL and KQL, and verified in both Splunk and Microsoft Sentinel. In Sentinel they run as hourly analytics rules on the live honeypot feed and raise incidents.
–rules
–test events
Contact
The best way to reach me is LinkedIn.