William | Cybersecurity & SOC Analyst

𝗦𝗢𝗖 𝗔𝗻𝗮𝗹𝘆𝘀𝘁 | 𝗕𝗹𝘂𝗲 𝗧𝗲𝗮𝗺 | 𝗦𝗜𝗘𝗠 (𝗦𝗽𝗹𝘂𝗻𝗸) • 𝗗𝗙𝗜𝗥 • 𝗧𝗵𝗿𝗲𝗮𝘁 𝗗𝗲𝘁𝗲𝗰𝘁𝗶𝗼𝗻 | Learning in public |

[William | Cybersecurity & SOC Analyst @WilliamInCyber]

🛡️ SOC Analyst in Training | Building in Public

28-day portfolio. Real detections. No tutorial replays.

• 🔍 Splunk | SIEM | Log Analysis
• 🧠 MITRE ATT&CK | Threat Detection
• 💻 Blue Team Home Lab Kali · Ubuntu · Windows
• 📜 ISC2 Certified in Cybersecurity

[William | Cybersecurity & SOC Analyst @WilliamInCyber]

5/ The path I am following:

Understanding first.
Practice second.
Certifications as a result not the other way around.

Cybersecurity is not a field for people who stop learning.

If you are building real skills not just collecting certs, this page is for you.

[William | Cybersecurity & SOC Analyst @WilliamInCyber]

Everyone told me to get Security+.

Nobody told me what to do after.

That gap between certification advice and real career readiness is exactly what I'm building in public. 1/5

[William | Cybersecurity & SOC Analyst @WilliamInCyber]

If you make assumptions, communicate unclearly, or base findings on guesswork, you are not helping the business.

Evidence. Facts. Clear findings. That is the job.

[William | Cybersecurity & SOC Analyst @WilliamInCyber]

- Re-scan → all ports now filtered
- ufw.log → block corroborated on defender side

README in SOC Tier 1 Incident Report format.
MITRE T1046 mapped. Evidence documented end to end.

https://t.co/DJEjkZA8ec

5/5

[William | Cybersecurity & SOC Analyst @WilliamInCyber]

1000 ports scanned in 37.7 milliseconds.

That's not a user.

I built a Bash detector to catch it, blocked the attacker IP,
then found a critical mistake in my own firewall response.

Here's the full SOC detection loop ↓

[William | Cybersecurity & SOC Analyst @WilliamInCyber]

The full evidence chain:

- Baseline → documented open ports before attack
- tcpdump → 2198 packets captured during scan
- Detector → flagged 1000 ports in 37.7ms
- Alert log → SIEM-ready structured output
- UFW → deny rule inserted at position 1

[William | Cybersecurity & SOC Analyst @WilliamInCyber]

The full breakdown.

A SOC without a baseline reacts to everything and understands nothing.

The tool tells you something happened.

The baseline tells you whether you should care.

That's what turns someone who detects events into someone who investigates them.

[William | Cybersecurity & SOC Analyst @WilliamInCyber]

Baselining was the lesson that finally made threat detection click for me.

For weeks I obsessed over detection rules.

Build the alert. Catch the bad thing. Repeat.

Then my home lab humbled me.

A thread on why "normal" matters more than alerts 🧵

[William | Cybersecurity & SOC Analyst @WilliamInCyber]

The technical payoff:

Once a baseline exists, deviation becomes the signal.

Failed logins at 3am from a new IP? Only suspicious if you know the box never sees that.

A process spawning cmd.exe? Only matters if it never did before.

Context turns noise into evidence.