End-to-end SOC automation lab: Sysmon → Wazuh → Shuffle → TheHive. Detects and triages Credential Dumping (MITRE T1003) in real time, cutting MTTR to seconds.

Production-grade SOC lab featuring Wazuh SIEM, Shuffle SOAR, and ServiceNow integration. Includes automated incident response playbooks, Active Directory deployment via IaC, and end-to-end telemetry pipeline documentation.