Alert triage and rule tuning
Enterprise monitoring with SIEM/SOAR, EDR/XDR, threat intelligence, IoC analysis, and false positive reduction.
SOC analyst / purple team mindset / Ankara - Istanbul
I trace signals through the dark.
Junior Cyber Security Analyst and Computer Engineer focused on alert analysis, detection validation, incident follow-up, and threat-informed defense.
USE TERMINAL CTF starts below- SIEM
- Splunk / QRadar / ArcSight
- Mode
- SOC + Purple Team
- Project
- LynxGate Web IDS
everything is logged
I (0000) telemetry: interface armed
0/20 EVENTS
THREAT HUNT
IoC correlation0x4F
TTP
YARA
Live security architecture
Built like a command center, written like a personal signal.
black-rabbit@soc:~
ctf signal: faint
online
Offense-informed defense
Penetration testing labs, AD attack simulations, privilege escalation, web exploitation, and Burp-driven traffic review.
Experience log
Signals collected from real operations.
A cleaner experience board from my CV. Turkcell carries the main SOC story; the other roles stay compact and open into detail panels.
2025 - Present / İstanbul
Cyber Security Analyst, Turkcell
SOC monitoring, alert analysis, malware and log investigations, customer communication, detection validation, rule tuning, false positive reduction, and Purple Team support.
Embedded product screens
LynxGate, shown from the real IDS interface.
LynxGate is my end-to-end Web IDS platform: Snort 3 detection, Docker Compose, FastAPI, Redis, PostgreSQL, and a React SOC dashboard for real-time alert monitoring. This read-only showcase presents the actual product screens without exposing the running system.
- 7,300+ official Snort web rules
- SQLi, XSS, path traversal, command injection, and web exploit detection
- Raw HTTP payloads, PCAP evidence, rule metadata, blacklist checks, and notifications
Core_Secure // Admin
Command Center
read-only product preview
Overview
Threat Mode Active
critical stream
128Today's alerts
17Active threats
4Critical alerts
3Secured segments
86%Resolution rate
+42Daily delta
Daily Alert Rhythm
last 24 hours / web gateway
spike 00:18 UTC
Severity Split
current incident window
Critical 24%
High 38%
Medium 29%
Attack Mix
top detections
Neural Stream
latest IDS events
Password file disclosure185.22.91.44
Union select probe203.0.113.51
Environment file request198.51.100.23
Reflected XSS payload91.208.43.17
Intrusions
Intrusion Events
triage table
Search by Source IP or Attack Type...
Critical
Flagged
TimestampAlert TitleSeverityStatus
Selected alert evidence
new
GET /etc/passwd HTTP/1.1 | Host: app.example.com | source: 185.22.91.44
Gateway access log and Snort JSON were correlated, then retained for analyst review.
Security
DETECTION_RULES
Snort profile
Active profile
web-official
engine in sync
alert tcp any any -> any 80 ( msg:"LOCAL LynxGate custom admin probe"; http_uri; content:"/lg-custom-trigger"; classtype:web-application-attack; sid:1000001; rev:1; )
Intelligence
Threat Intelligence
7 days
126Period Volume
18Unique Attackers
42%SQLi Ratio
91%Triage Completion
Attack type distribution, protocol mix, severity split, and daily trend analysis from retained IDS telemetry.
Defense
Intrusion Defense
response layer
Blacklist checksactive
Gateway policymonitoring
Email notificationarmed
The Defense screen shows the response layer that turns IDS alerts into operational follow-up: blacklist checks, notification flow, and response state.
/containment
Your call, analyst
0/0
An alert reached the queue. Read the context, then choose a response. Every option is defensible somewhere; only one fits this alert.
critical
Management
Protected Origins
workspace
app.example.comprotected
demo-origin:8081upstream
ids-gateway:8080edge
The Management screen summarizes how protected web origins connect through the gateway into Snort and backend telemetry.
Live test
Detection Sandbox
rule engine online
Send a request at the protected origin and watch the rule engine decide. Nothing leaves your browser: matching runs locally against the same Snort rule classes LynxGate ships.
Detection coverage
0/8
/ctf-fragment
Full rule coverage reached
Black Rabbit arcade
Pixel rabbit carrot run.
A tiny offline-runner inspired arcade mode: jump over packets, collect pixel carrots, and keep the signal alive.
/ctf-fragment
Rabbit Run fragment captured
/scoreboard
Top Rabbit Signals
- Scoreboard loading...
Space / click / tap to jump
Tooling and tactics
Cybersecurity arsenal
SplunkIBM QRadarArcSightSOAR
Carbon BlackNetWitnessRecorded Future
Malware AnalysisIoC AnalysisRule Tuning
Burp SuiteNmapMetasploitSQLmap
Active DirectoryPythonDockerFortinet
Contact
Send a signal.
Available for cybersecurity collaboration, SOC analysis, defensive research, and security-focused engineering work.
waiting_for_signal()
Signal log
Leave a signal behind.
A name is optional. Leave it blank and the signal is anonymous - the rabbit will not ask twice.
