threat_intel_hunter
Threat Intel CLI
- Signal
- Threat intelligence, API correlation, scoring, reporting
- Evidence package
- Working CLI change, safe fixtures, JSON report, tests, and analyst writeup
Working tools. Operational writeups. Evidence.
Build proof an employer can inspect.
These are not screenshot-only labs. Each project includes a working artifact, safe sample data, tests, limitations, an analyst writeup, and a short demonstration.
3First-cohort projects
6Evidence layers per project
80%Portfolio rubric pass mark
0Live targets or private data
EventLogTutorialThriveDX
Event Log Dashboard
- Signal
- Telemetry, normalization, visualization, investigation
- Evidence package
- Synthetic event set, dashboard, verified timeline, and anomaly summary
SecureWatch
SecureWatch KQL Hunt Pack
- Signal
- Threat hunting, KQL, MITRE mapping, detection tuning
- Evidence package
- Four hunts, test fixtures, expected results, and false-positive notes
The review standard
A tool is not proof until the evidence holds up.
Every submission is scored for functionality, defender usefulness, evidence quality, communication, tuning, and professional packaging. A real secret, private data, unauthorized target, or live malware fails the safety gate before scoring.
100points
Portfolio artifact rubric
25 functionality · 20 defender usefulness · 20 evidence · 15 communication · 15 analysis · 5 packaging