Skip to content
View Rokkside's full-sized avatar

Block or report Rokkside

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
Rokkside/README.md

Orok Ironbar's IT and Cybersecurity Project Portfolio πŸ”

I'm passionate about cybersecurity and love tackling complex challenges through hands-on projects. From vulnerability management to threat detection, these projects allow me to dive deep into the ever-evolving landscape of cybersecurity. Please feel free to check them out and see the work I’ve put into enhancing security operations and processes!

⚠️ Vulnerability Management Projects

🚨 Threat Hunting and Security Operations

πŸ” Windows 11 STIG Automation Lab

This project demonstrates the implementation, troubleshooting, and validation of Windows 11 STIG controls using PowerShell in a hands-on lab environment.

🎯 Objective

  • Automate STIG compliance using PowerShell
  • Identify failed controls using Tenable vulnerability scans
  • Remediate and validate security configurations
  • Understand real-world policy conflicts (GPO vs Local vs Legacy)

πŸ§ͺ Lab Workflow

  1. Run Tenable scan β†’ Identify FAILED STIG control
  2. Implement remediation via PowerShell
  3. Validate locally (auditpol, registry, etc.)
  4. Re-run scan β†’ Confirm PASS

πŸ“Œ Implemented Controls

πŸ”Ή WN11-AU-000050 – Audit Process Creation

  • Enables Detailed Tracking β†’ Process Creation (Success)
  • Uses auditpol for configuration
  • Generates Event ID 4688 for process execution visibility

⚠️ Troubleshooting Insight:

  • Initial configuration failed due to legacy audit policy overriding advanced audit settings
  • Resolved by enabling:
    SCENoApplyLegacyAuditPolicy = 1
    
    

🀳 Connect With Me

πŸ› οΈ Technical Skills & Tools

☁️ Cloud & DevOps

AWS Terraform Docker

πŸ’» Programming & Systems

Python Linux

πŸ” Cybersecurity & Detection Engineering

Microsoft Defender Microsoft Sentinel SIEM MITRE ATT&CK KQL

🧰 Tools & Platforms

Git GitHub Wireshark Trello

Pinned Loading

  1. microsoft-sentinel-incident-response-labs microsoft-sentinel-incident-response-labs Public

    Hands-on Microsoft Sentinel incident response labs covering detection, investigation, and response using KQL, Defender telemetry, and NIST 800-61 methodology.