ids-ips

Open-source IDS/IPS, WAF and bot detection for Linux, Windows, Docker and Kubernetes, with a crowdsourced blocklist of malicious IPs.

Projet de fin de formation: infrastructure reseau securisee avec pfSense, PKI, OpenVPN, pfBlockerNG et Snort IDS/IPS.

SentinAI: A localized SOC toolkit and Hybrid IDS/IPS utilizing a dual-engine architecture (Heuristics + ML/IsolationForest) for real-time network threat detection.

Ciclo completo de auditoría, detección y remediación con Wazuh (SIEM), Suricata (IDS), Nmap, Hydra y Metasploit. Mapeo a ISO 27001/27005 y NIST 800-53.

A compact, self-contained lab that demonstrates real-time intrusion detection and automated response using an IDS script (Scapy), Cisco router ACLs (Netmiko), and victim host hardening (Paramiko + iptables).

A SOC lab platform integrating IPS/IDS/WAF using pfSense, WAF, web/database servers, IDS, and ELK, including network topology diagrams, VMware VMnet setup, and IP/subnet design.

Security-focused distributed NAS platform built using Nextcloud, Docker, Grafana, Prometheus, and fail2ban with real-time monitoring, security event logging, brute-force detection, infrastructure observability, and centralized dashboard monitoring.

Linux UTM Gateway — integrated UTM firewall appliance for Debian: nftables, Suricata IPS, Squid, ClamAV, content and HTTPS filtering, OpenVPN/WireGuard/IPsec, HA cluster. A pfSense / Kerio Control alternative. ISO: https://t.me/Linux_UTM

Wazuh alert rules for Ubiquiti UniFi CEF syslog: IDS/IPS threats, honeypot, rogue AP, admin logins, config and firewall changes, WAN outages and offline devices. Pairs with wazuh-unifi-decoder.

A modular Python-based SIEM/IPS that monitors system logs in real-time (Sentinel) and automates threat response (SOAR). It features Regex-based log normalization, hybrid event correlation (SSH/Web), and automated firewall blocking integrated with AbuseIPDB and Discord alerts.

Segmented enterprise network lab with pfSense, Suricata IDS/IPS, and attack simulation

NT405 - Cyber Security

A cloud-native security lab on AWS that automates threat detection and compliance enforcement. Deploys a 3-tier VPC with Suricata IDS/IPS, ModSecurity WAF, Duo MFA, WireGuard VPN, and ELK Stack — all provisioned via Terraform, configured with Ansible, and continuously validated with InSpec compliance-as-code checks.

PiNetCore - Production-ready Raspberry Pi 5 network appliance. Rust-based packet capture engine with modular plugin architecture, nftables firewall, and TypeScript/React dashboard. Features inline bridge mode, VPN integration (WireGuard/OpenVPN), IDS/IPS support, and centralized logging. Built for home labs and advanced network control.

Wazuh decoder for Ubiquiti UniFi CEF syslog (SIEM integration). Parses logs from UDM Pro, UDM SE, Cloud Gateway and Cloud Key into ~150 fields. Tested on UniFi Network 10.x and Wazuh 4.14.

Projecte intermodular ASIX: Docker, Kubernetes, Helm, Istio, Ansible i Suricata IDS/IPS. Del contenidor local a la producció cloud-native amb ciberseguretat activa.

Open-source firewall for homelabs and power users: nftables, Suricata, Unbound, a modern web UI, REST API and CLI.

Enterprise SOC home lab on AWS with Splunk SIEM, Wazuh EDR, Suricata IDS/IPS - 6 detection rules, 5 dashboards, MITRE ATT&CK mapped

Autonomous IDS/IPS with ensemble ML voting, post-quantum cryptography, Kubernetes Zero Trust, self-healing watchdog, and live SOC dashboard

Network Security Advanced course notes - CET2883C Santa Fe College