Projects using SplunkProjects using Splunk
Projects
People
Cover image for Why JWT isn't enough to
Why JWT isn't enough to secure your app When I first started building authentication systems, I thought: "If I'm using JWT, my app is secure." I was wrong. JWT solves authentication—it tells your server who the user is. It doesn't automatically solve: Authorization (What is the user allowed to do?) Token theft Token revocation after logout XSS or CSRF attacks Rate limiting Input validation Secure storage of tokens A secure application is built with layers, not a single technology. Here's what I consider a solid authentication stack: Short-lived access tokens Refresh token rotation HttpOnly & Secure cookies Role-Based Access Control (RBAC) Input validation and sanitization Rate limiting Security headers Continuous logging and monitoring One lesson I've learned: Security isn't something you add after your app works. It's something you design into every feature from the beginning. JWT is one piece of the puzzle—not the whole picture. What's one security practice you think every full-stack developer should implement by default?
0
124
Cover image for Fraud and abuse detection wired
Fraud and abuse detection wired into a SIEM Card-testing and brute-force detection routed to on-call with a runbook attached to every alert. Who it was for: A payments platform exposed to automated card-testing traffic. The problem. Automated enumeration against payment endpoints is both a fraud loss and an availability threat, and it doesn't announce itself. Without detection it looks like ordinary traffic until the chargebacks arrive. What I did. Built the log pipeline into the SIEM, then wrote detections for card-testing patterns, brute force and anomalous transaction behaviour. Tuned edge rate-limiting and bot controls to cut volume at the perimeter. Every alert routes to on-call with a runbook attached, so whoever is paged at 3am has the next step in front of them. The result. Repeat attempts are caught as they start rather than reconstructed afterward, and response is a documented procedure instead of improvisation.
0
42
Cover image for Most small IT teams collect
Most small IT teams collect logs but never actually investigate them. That's exactly what attackers count on. Over the past several months, I've been building hands-on SOC skills — analyzing Windows Event Logs, running SIEM investigations in Splunk and Wazuh, and reconstructing full attack timelines across ransomware, brute-force, and phishing scenarios. Here's what I've learned: logs don't lie. Every failed login attempt, every unauthorized account creation, every suspicious process execution leaves a trace. The challenge is knowing where to look and how to connect the dots. Some things I can help you identify from your logs: • Brute-force attack patterns and successful compromise indicators • Unauthorized account creation and credential manipulation • Suspicious authentication anomalies and privilege escalation attempts • Attack timelines mapped to MITRE ATT&CK techniques I deliver structured investigation reports that turn raw log data into clear, actionable findings — so you know exactly what happened and what to do next. If your team is sitting on unreviewed logs or needs support investigating a security event, I'd love to help. 👉 Check out my service below — starting at $30. https://contra.com/s/7FecLZcc-soc-analyst-log-investigation-and-threat-detection-support?r=alkhal_vio107rc
0
61