status: active — monitoring
Rabya Hassan
SOC Analyst in training.
SOC L1 Intern @ ZTBL and cybersecurity student, focused on threat monitoring, SIEM tooling (Wazuh/Elastic), and vulnerability assessment.
$ whoami
rabya_hassan — soc_l1_intern, cybersecurity_student
$ cat focus.txt
threat_monitoring · wazuh/elastic · vulnerability_assessment
$
01
About .
I'm a cybersecurity student currently working as an L1 SOC Intern at ZTBL, where I spend my days triaging alerts, tuning detections, and learning how real security operations actually run — not just the theory.
My focus sits at the intersection of threat monitoring and vulnerability assessment: watching logs for what shouldn't be there, and testing systems before someone else does.
Outside of internship work, I practice on TryHackMe and build small tools and lab write-ups to keep sharpening both the offensive and defensive sides of security.
// current_status.log
roleSOC L1 Intern
orgZTBL
universityAir University
learningSOC Level 1 — TryHackMe
certificationCC (ISC2) — in progress
availabilityOpen to opportunities
02
Skills .
Threat Monitoring / SIEMproficient
Wazuh / Elastic Stackproficient
Vulnerability Assessmentintermediate
Network Security Fundamentalsintermediate
Incident Response Basicsdeveloping
// edit levels in index.html — search "meter-fill" to adjust
03
Experience .
SOC L1 Intern (Onsite)
ZTBL (Zarai Taraqiati Bank Limited)
- Monitor and triage daily SIEM/IDS alerts across Wazuh and Elastic, escalating confirmed incidents per SOC playbooks.
- Track vulnerability findings and incidents in Jira through remediation.
- Collaborate with a blue team shift to investigate suspicious network activity and produce incident reports.
BS Cybersecurity Student
Air University
Coursework spanning Cryptography, Network Security, Operating Systems, and Information Assurance.
SOC Level 1 Path
TryHackMe — 30+ rooms completed
Working through the SOC Level 1 learning path — log analysis, SIEM fundamentals, and alert triage.
Certified in Cybersecurity (CC)
ISC2
Preparing for the ISC2 CC certification, covering security principles, access control, network security, and incident response.
04
Projects .
CASE-001complete
AES-128 — Memory-Optimized Cryptography
Implemented AES-128 from scratch in C++, comparing a baseline build against memory-optimized versions (on-the-fly S-box, on-demand key schedule). Achieved an 89.3% memory reduction, benchmarked the space-time trade-off, and verified output against the NIST AES-128 test vector.
C++CryptographyGF(2^8)Benchmarking
→ view report (PDF)
CASE-002complete
Snort IDS — Evaluation + ML Enhancement
Critical evaluation of Snort's architecture, strengths, and limitations — including alert fatigue and its zero-day blind spot — with a proposed hybrid ML anomaly-detection layer for adaptive rule generation and false-positive suppression.
SnortIDS/IPSNetwork Security
→ view report (PDF)
CASE-003complete
AWS IAM — Identity & Access Management
Configured IAM users and groups with least-privilege policies on AWS, enabled MFA for account security, and set up a custom password policy to enforce stronger authentication standards.
AWS IAMCloud SecurityMFA
→ view report (PDF)
CASE-004complete
Network Scanning & Traffic Analysis
Used Nmap for port and service discovery and Wireshark for live packet capture, applying DNS/HTTP/TCP filters to analyze traffic flow. Documented findings on exposed services and unencrypted data, with prevention recommendations.
NmapWiresharkKali Linux
→ view report (PDF)
CASE-005complete
Enterprise VLAN Network — GNS3 Simulation
Designed and configured an 8-VLAN network in GNS3 with router-on-a-stick inter-VLAN routing and trunked switches, then validated full connectivity across all subnets with ping testing.
GNS3Cisco IOSVLANsRouting
→ view report (PDF)
CASE-006complete
Windows 11 System Hardening
Hardened a Windows 11 endpoint via Local Security Policy — password and account lockout rules, audit logging, least-privilege user rights, and security options — validated through Event Viewer testing and mapped to NIST SP 800-53 principles.
Windows Securitysecpol.mscNIST 800-53
→ view report (PDF)
CASE-007complete
ELK Stack — Secured 2-Node Cluster
Deployed a TLS-secured, two-node Elasticsearch cluster with Kibana and Logstash. Covers CA/certificate generation and distribution, encrypted transport and HTTP layers, user password rotation, and a Logstash pipeline shipping syslog data into Elasticsearch for analysis in Kibana.
ElasticsearchKibanaLogstashTLS
→ view guide (PDF)
CASE-008complete
SOC Home Lab
Built a virtualized SOC environment in VirtualBox with HIDS detection pipelines, correlating Wazuh and Elastic alerts for end-to-end incident analysis.
WazuhElasticVirtualBox
CASE-009complete
Phishing Email Investigation — Header & Auth Analysis
Full SOC L1-style triage of a suspicious marketing email: parsed raw headers via MXToolbox, verified SPF/DKIM/DMARC alignment, cross-checked From/Reply-To/Return-Path, and traced sending infrastructure and embedded URLs to reach a documented true-negative determination — plus a side-by-side of what would flip the verdict to phishing.
Email HeadersSPF/DKIM/DMARCMXToolbox
→ view report (PDF)
CASE-010complete
Reconnaissance — Passive & Active
Performed passive OSINT, WHOIS, and DNS reconnaissance alongside active Nmap scanning to profile target infrastructure and document attack surface.
NmaptheHarvesterShodanMaltego
CASE-011complete
OWASP Top 10 — 17 Hands-On Vulnerability Labs
Solved 17 PortSwigger Web Security Academy labs spanning information disclosure (error messages, debug pages, backup files, version control history), JWT authentication bypass (unverified/flawed signatures, weak keys, jwk/kid header injection, algorithm confusion), and business logic flaws (client-side trust, negative-quantity abuse, coupon logic, integer overflow) — each with reproduction steps, evidence, and remediation.
PortSwigger AcademyBurp SuiteJWT Editor
→ view report (PDF)
CASE-012complete
Removable Media Detection — Wazuh SIEM
Deployed Wazuh manager + agent end-to-end, enabled Windows PnP audit logging, and authored a custom XML detection rule matching Event ID 6416 against the USBSTOR service to fire real-time alerts on USB mass-storage insertion — verified live with a physical device and mapped to NIST 800-53 / ISO 27001 controls.
WazuhWindows Event LogsSIEM Rules
→ view report (PDF)
05
Contact .
// reach_me.cfg
linkedinlinkedin.com/in/rabya-hassan
tryhackmetryhackme.com/p/headerfile
githubgithub.com/hassanrabya