PROOF OF WORK
Everything else on this site is a claim. This is the part you can verify — the detection logic is public, and the tooling below is what I actually touch.
Everything above is a claim. This is the part you can verify. The detection-as-code approach I keep referring to is not rhetorical — the rules, the hunting queries and the validation methodology are public.
github.com/Pramod1336 /
crowdstrike-ngsiem-detection-engineering
Production-focused CrowdStrike Falcon NG-SIEM detection engineering content — CQL detections, Cisco Meraki correlation rules, threat hunting queries, validation methodology and MITRE ATT&CK mapping. This is the repository behind the coverage matrix at the top of this page.
WHY THIS IS HERE
A portfolio that claims detection engineering without showing a rule is asking you to
take its word for it. Read the CQL, check the ATT&CK mappings, disagree with the
tuning decisions — that is a better interview than either of us reciting bullet
points.
CURRENTLY BUILDING
A SOCRadar-based MCP server that enriches SIEM alert data with threat-intelligence
context, so the analyst sees reputation and campaign detail inside the alert instead
of pivoting to another console mid-triage.
SIEM / MONITORING
- Falcon NG-SIEM
- Splunk
- Microsoft Sentinel
- Securonix
- Wazuh
- FortiSIEM
ENDPOINT / EDR
- CrowdStrike Falcon
- TrendMicro Vision One
- Trellix EDR/ENS
- WatchGuard
- Kitecyber
SOAR / AUTOMATION
- Falcon Fusion SOAR
- Playbook design
- Auto-remediation
- Alert correlation
DETECTION ENG
- Custom rule dev
- GitHub rule repo
- Multi-client deploy
- Rule tuning
IDENTITY
- Conditional Access
- ITDR
- IAM controls
INVESTIGATION
- MITRE ATT&CK
- IOC analysis
- Threat hunting
- Threat intel enrichment
- Root cause analysis
AI-AUGMENTED
- Falcon MCP Server
- SOCRadar MCP Server
- CrowdStrike AIDR
- Agent-assisted triage
- Threat intel enrichment
CLOUD
- AWS
- Azure
- Cloud security audits
- Cloud detection coverage
NETWORK
- TCP/IP · DNS · HTTP/S
- Traffic analysis
- Security policy