Wazuh SIEM Home Lab
Self-built detection lab: Wazuh manager + agents, log pipelines, and custom rules mapped to MITRE ATT&CK. Python tooling for alert triage.
View on GitHub ↗SOC Analyst · Detection & Incident Response
I build, break, and defend — then document how.
I’m Mahfut Abdi (ZeroDayHakim). I’m moving into blue-team security operations: detection engineering, threat hunting, and incident response. This site is itself a security artifact — hardened headers, strict CSP, and a documented writeup of every choice.
Selected work
Projects & labs
Content Trust Platform
FastAPI service that analyzes writing for authenticity signals. CI-disciplined security-engineering project deployed on Render.
View on GitHub ↗Audio-Deepfake Defense Lab
Defensive research into voice-cloning detection, built under a documented rules-of-engagement charter with safety-first design.
View on GitHub ↗Technical writing
Writeups
Detection walkthroughs, incident investigations, and theHardening Notes for this very site — documenting the CSP, HSTS, and email-authentication decisions — land here. This section is wired for Markdown/MDX content as the next build step.
Background
About
I spent five years running humanitarian programs in high-stakes, resource-constrained environments — coordinating teams, managing risk, and documenting everything under pressure. Those instincts transfer directly to a SOC: triage, evidence discipline, and clear incident communication.
I hold the Google Cybersecurity Professional Certificate, am preparing for CompTIA Security+, and study graduate computer science through the CU Boulder MS-CS pathway. I learn by building — home labs, detection rules, and automation — not by memorizing.