CISA KEV → Jira Pipeline production
Daily GitHub Actions job that diffs the CISA Known Exploited Vulnerabilities catalog against committed state and opens a Jira ticket for every new CVE. Idempotent, fail-forward, state versioned in git. Rebuilt in Sept 2026 after finding a silent-failure mode: the job had reported success for six weeks while every Jira call failed. Now fails loudly, retries transient errors, and publishes its own stats to this site.
# Python · GitHub Actions · Jira REST v3 · CISA KEV feed
Web Infrastructure Hardening live · A+
This site and reservoirsecurity.com on one nginx host behind Cloudflare. Took both from TLS 1.0 / no headers / version disclosure to TLS 1.2+, strict CSP, HSTS, Full (strict) origin validation, and real client IPs restored at the origin. A+ on SSL Labs for both domains. Config and site source versioned with a one-command, self-validating deploy.
# Nginx · Cloudflare · Let's Encrypt · CSP · DigitalOcean · Ubuntu 24.04
SOC Stack on Kubernetes in progress
Self-hosted SIEM → SOAR pipeline on k3s: Wazuh for detection, Kafka for alert streaming, TheHive + Cortex for case management and enrichment, Shuffle for automated response. Custom Wazuh rules for Kubernetes audit events (RBAC changes, hostPID pods, exec, secrets access, crypto miners) mapped to MITRE ATT&CK, and a least-privilege service account for containment actions. Being redeployed on dedicated hardware; response playbooks are the current work.
# Wazuh · TheHive · Cortex · Shuffle · Kafka · k3s · Helm
URLhaus Threat Intel Monitor production
Second intake on the KEV pipeline pattern, redesigned for a feed that adds hundreds of URLs a day: one daily digest ticket grouped by malware family, plus individual tickets for a watchlist of families (CobaltStrike, Mirai, Lumma, Emotet…). Rolling 30-day state window, fail-loud from day one.
# Python · GitHub Actions · URLhaus API · Jira API
XSS Detection Rules for Nginx Logs planned
Custom Wazuh rules for CWE-79 patterns in nginx access logs (reflected, stored, DOM-based vectors), tuned against real scanner traffic from this host once it's enrolled as a Wazuh agent. Depends on the SOC stack redeploy.
# Wazuh · Detection rules · Nginx log parsing · CWE-79 · ATT&CK T1189