Interactive SIEM: write KQL-style queries over real logs, detect the attack and isolate the actor. My Azure Sentinel specialty, playable in the browser.

KQLSIEMDetection

Open lab →

🐕

Red Team · Active Directory

BloodHound AD Simulator

Active Directory attack-path simulator: enumerate, chain privileges and reach Domain Admin. See how an attacker thinks inside a domain.

Active DirectoryPrivescGraph

Open lab →

🏗️

Architecture · GRC

Secure Architecture Designer

Generates a tailored security architecture (size, ecosystem, compliance) with a diagram, controls and cost estimate. From theory to real design.

Zero TrustComplianceDesign

Open lab →

📂 See projects & manuals →

// FROM THE BLOG

Latest articles

Technical notes from an analyst: detection, hardening and response.

Blue Team The Windows Event IDs every SOC should watch You don't need to watch 400 event types: you need the right ones. The Windows Event IDs that tell the story o… Read → Blue Team From a CVE to a detection: from the advisory to a rule that catches the attack A CVE advisory tells you what breaks, not how to detect it. The method to go from an advisory to a detection:… Read → AppSec Understand a regex (and avoid taking your server down with ReDoS) Reading a regular expression token by token, and the trap that turns an innocent validation into a DoS: catas… Read →

See the whole blog →

// WHO BUILDS THIS

Sergio Belmonte Morales

Cybersecurity Analyst (SOC · Azure Sentinel/KQL · eCPPT). This platform is my lab — I built every tool on it myself.

About me → 📄 CV Contact 🌍 Threats & 0-days