Profile & evidence

Portfolio brief

A concise overview of my work, with original results and source links.

Cybersecurity Analyst · SOC

Sodik Tursunboev

Warsaw, Poland

CEH-certified cybersecurity analyst with practical experience in Windows/Linux log analysis, threat detection, phishing investigation and incident response. Hands-on with Splunk, the Elastic Stack and SIEM/SOAR/EDR tooling in security projects and labs.

Education

Vistula University

Bachelor’s degree in Computer Engineering · Cybersecurity

Full-time · In progress

hello@sodik.eu View full CV Download CV (PDF)

Tools & investigation methods

Tools and methods I use for security analysis and investigations.

  • Splunk; Elastic Stack (ELK: Elasticsearch, Logstash, Kibana); SIEM, SOAR and EDR tooling.
  • Windows/Linux log analysis, alert triage, phishing and malware investigation, digital forensics and incident response.
  • Sigma, MITRE ATT&CK, Active Directory, web application testing (OWASP), Python, PowerShell and Bash.

What my projects demonstrate

Independent security projects, with case studies and source code.

Custom SIEM + Sentinel BAS

Detection validation

Test a detection, investigate a miss and explain the result.

My contribution
Built the SIEM, Sentinel BAS simulations and alert-to-test matching.
Outcome
Seven simulations produced matching alerts; three did not. A missing parser field explained the Kerberoasting miss.

Technical questionHow did a missing parser field prevent the Kerberoasting rule from firing?

Read case study Source code

Active Directory Purple Team Lab

Windows investigation

Connect identity, process and domain activity into a defensible investigation trail.

My contribution
Built the lab, reproduced the attack chain and documented defensive findings.
Outcome
Recorded Windows Security, Sysmon and OpenSSH evidence across the attack chain.

Technical questionWhich events support the attack path, and what additional telemetry would you need?

Read case study Source code

ARGUS

Security automation

Separate an assistant’s proposed actions from the permissions required to execute them.

My contribution
Developing the assistant, V2 HUD, agent kernel, Windows skills, monitoring and backend security controls.
Outcome
Public Windows source release with voice, desktop workflows, bounded agents, a 3D state view and documented setup.

Technical questionWhere is authorization enforced, and what can the model never approve for itself?

Read case study Source code

Discuss a project