Threat Intel
ThreatLens
Full-stack blue-team threat-intelligence platform — ingest, enrich, score, correlate and investigate IOCs end to end. FastAPI backend with JWT auth, role-based access control and audit logging; a React + TypeScript dashboard with an interactive threat graph. Runs fully offline on a deterministic mock feed, with AbuseIPDB, VirusTotal and OTX activating when API keys are set.
FastAPI / React / TypeScript / Threat Intel / Docker
MH01
SOC
Phishing Email Analyzer
CLI tool that pulls apart a suspicious email the way a SOC analyst would: SPF/DKIM/DMARC checks, Received-chain tracing, IOC extraction & defanging, static attachment inspection — and an explainable risk score where every point traces to a named finding. Static analysis only; no link is fetched and no attachment is run.
Python / SOC / Email Security / IOC Analysis
MH02
Cloud Security
IAM Least Privilege
Audits AWS IAM configurations for excessive permissions and privilege-escalation paths, then generates least-privilege policy recommendations mapped to NIST SP 800-207 and AWS best practice — cloud entitlements reviewed the way an analyst would, at scale.
AWS / IAM / Cloud Security / NIST 800-207
MH03
DevSecOps
Docker Security Pipeline
Hands-on DevSecOps pipeline that hardens a Flask app from build to ship: a multi-stage, non-root Docker build on digest-pinned base images, a Trivy CI gate that fails on vulnerable layers, plus SBOM generation with Syft and Docker Scout scanning — security shifted left into the build itself.
Docker / DevSecOps / Trivy / CI/CD / SBOM
MH04
Network Security
Network Segmentation Advisor
Turns an Nmap scan or YAML inventory into a least-privilege segmentation plan. Classifies each host by role and sensitivity, groups them into security zones, and outputs the allow/deny rules needed to enforce them — network threat modelling reduced to a repeatable command.
Python / Nmap / Network Security / Threat Modelling
MH05
DFIR
Memory Forensics Investigation
Repeatable DFIR workflow built on Volatility 3 — memory image in, integrity-verified evidence pack out. Triages captured RAM for malicious processes, injected code, C2 traffic and persistence, then produces MITRE ATT&CK-mapped, evidence-led investigation reports across four worked cases.
Python / Volatility 3 / DFIR / MITRE ATT&CK
MH06
Tooling
Password Generator
Secure CLI password generator in Python with Have I Been Pwned breach checking via k-anonymity — only a hash prefix ever leaves the machine — plus customisable character sets and an auto-clearing clipboard.
Python / HIBP / k-Anonymity / CLI
MH07
Infrastructure
Grafana on K8s with CloudFormation
Deploys a Grafana observability stack on Kubernetes using AWS CloudFormation for infrastructure provisioning.
AWS / Kubernetes / Grafana / CloudFormation
MH08