raghv.dev

PROJECTS

Operational Evidence

11 projects spanning security engineering, full-stack development, and infrastructure operations. Built in the home lab, shipped to production, and documented in detail.

FEATUREDACTIVE

HomeLab Corp

Enterprise Security Simulation

A 4-node enterprise network simulation built on real hardware. DC-01 runs Active Directory with full domain infrastructure. WEB01 hosts production web services behind Nginx. KALI01 runs attack exercises that generate real telemetry. WAZUH01 aggregates all logs, runs detection rules, and fires alerts. This is not a virtual sandbox — it's a production-grade simulation environment.

12+ custom Wazuh detection rules deployed

SSH brute force detection with IP blocking

Real-time file integrity monitoring on all endpoints

Windows Server 2022Ubuntu 22.04WazuhActive DirectoryKali Linux
FEATUREDIN PROGRESS

SOC Training Platform

Cyberpunk Incident Response Simulator

An immersive SOC analyst training platform with a cyberpunk aesthetic. Features real-time alert queues, an interactive network topology map in 3D, case management workflows, and SIEM log analysis exercises. Designed to simulate the experience of a Tier 1 SOC shift without needing access to enterprise tooling.

3D network topology with Three.js

Real-time alert simulation engine

Case escalation workflow with state management

Next.js 15React Three FiberZustandTypeScriptFramer Motion
FEATUREDSHIPPED

ImmigrateX

Immigration SaaS Platform

A full-stack SaaS platform for immigration professionals. Multi-tenant architecture with role-based access control, document management with encryption at rest, Stripe payment integration, and email automation. Deployed on Ubuntu with Nginx reverse proxy, SSL/TLS via Let's Encrypt, and PM2 process management.

RBAC with Principle of Least Privilege

Encrypted document storage on AWS S3

Stripe payment integration with webhook handling

Next.jsPostgreSQLStripeAWS S3Ubuntu Server
SHIPPED

RBAC Security App

Role-Based Access Control Demo

Production RBAC implementation demonstrating Principle of Least Privilege. Custom permission system with granular route-level and resource-level access control. Audit logging for all permission changes. Used as a reference implementation for client projects.

Granular permission matrix with 6 roles

Audit trail for all access control changes

Parameterized queries throughout — zero raw SQL

Next.jsNextAuthPrismaPostgreSQL
SHIPPED

Chattr

Real-Time Messaging Platform

Real-time messaging application with end-to-end encrypted channels, file sharing, and presence indicators. WebSocket server with Redis pub/sub for horizontal scaling. Security-first implementation — no message content logged on the server, ephemeral session keys.

WebSocket authentication with JWT rotation

Redis pub/sub for scalable real-time events

No plaintext message storage — forward secrecy design

Next.jsSocket.ioRedisMongoDBDocker
ACTIVE

Wazuh Detection Rules

Custom SIEM Rule Library

Library of custom Wazuh detection rules authored for the home lab environment. Covers SSH brute force detection, Nmap scan detection, Hydra credential attack identification, web application attack patterns (Gobuster, Dirb), and Windows event log rules for domain controller anomalies.

SSH brute force: detect after 5 failed attempts in 60s

Nmap SYN scan detection via iptables integration

Wazuh active response — automatic IP block on trigger

WazuhXMLPythonUbuntu
SHIPPED

3D Chess Engine

Three.js Browser Chess

Browser-based 3D chess game built with Three.js. Full chess rules with check/checkmate detection via chess.js. Smooth piece animations, interactive camera rotation, and legal move highlighting. Used as a deep-dive into 3D graphics and WebGL rendering — directly applicable to security visualization work.

Custom 3D piece models in WebGL

Full legal move validation engine

Animated camera and piece movement system

Three.jsJavaScriptWebGLChess.js
ACTIVE

Security Log Parser

Python Log Analysis Tool

Python tool for parsing and normalizing security logs from multiple sources — Wazuh JSON exports, syslog, Windows Event XML. Outputs normalized CSV for import into analysis tools. Includes pattern matching for common attack signatures and timeline reconstruction for incident investigations.

Multi-format log normalization pipeline

Attack pattern signature matching library

Timeline reconstruction for IR exercises

Python 3pandasregexJSON
SHIPPED

raghv.dev Portfolio

This Site — Premium Cybersecurity Brand

This portfolio — built with security and premium UX as primary requirements. Full security hardening: CSP headers, CSRF protection on forms, rate limiting (3 contacts/hour), IP hashing before storage, honeypot field, no raw IPs ever stored. R3F 3D particle field, custom gold cursor, grain overlay, and animated terminal.

CSP + HSTS + X-Frame-Options security headers

CSRF tokens + Zod validation on all API routes

Rate limiting with RateLimiterMemory (3/hour contact)

Next.js 15React Three FiberFramer MotionPrismaNextAuth
ACTIVE

Network Scanner Script

Python Nmap Automation

Python wrapper around nmap that automates network discovery scans in the lab environment, stores results in SQLite, and diffs against previous scans to identify new hosts, open ports, or changed service versions. Used to maintain an accurate asset inventory of the home lab network.

Automated scan scheduling via cron

Change detection against historical scan baseline

JSON report generation for Wazuh integration

Python 3python-nmapJSONSQLite
ACTIVE

AD Security Baseline

Windows GPO Hardening Pack

Group Policy Objects for hardening the home lab domain (HOMELAB.CORP). Implements CIS Benchmark recommendations: account lockout policies, password complexity, audit policy, SMB signing enforcement, LLMNR disable, PowerShell logging, and Windows Event Forwarding to Wazuh. All GPO settings documented and version-controlled.

CIS Benchmark L1 compliance for domain accounts

PowerShell ScriptBlock logging for all hosts

Windows Event Forwarding → Wazuh alert pipeline

Windows Server 2022PowerShellGroup PolicyWazuh
[INFO] Wazuh agent heartbeat · DC-01 · homecorp.local · OK·[WARN] Failed SSH auth attempt · 192.168.56.102 · Rule 5710 · Level 5·[INFO] Nmap scan completed · WEB01 · 23 open ports detected · Logged·[ALERT] Hydra brute-force detected · admin@192.168.56.101 · BLOCKED·[INFO] SPL query executed · index=security · 4,892 events returned·[INFO] ISC2 CC · PASSED · 2024 · Credential active·[INFO] CompTIA Security+ SY0-701 · PASSED · 2025 · Credential active·[WARN] Gobuster scan detected · /api/admin · 403 returned · Alert fired·[INFO] Wireshark PCAP capture · eth0 · 12,441 packets · Saved·[INFO] System status · LEARNING · BUILDING · AVAILABLE FOR SOC ROLES·[INFO] GPO applied · homecorp.local · Password policy · min 12 chars·[ALERT] Nikto scan from KALI01 · WEB01 · Wazuh alert · Severity: High·[INFO] Wazuh agent heartbeat · DC-01 · homecorp.local · OK·[WARN] Failed SSH auth attempt · 192.168.56.102 · Rule 5710 · Level 5·[INFO] Nmap scan completed · WEB01 · 23 open ports detected · Logged·[ALERT] Hydra brute-force detected · admin@192.168.56.101 · BLOCKED·[INFO] SPL query executed · index=security · 4,892 events returned·[INFO] ISC2 CC · PASSED · 2024 · Credential active·[INFO] CompTIA Security+ SY0-701 · PASSED · 2025 · Credential active·[WARN] Gobuster scan detected · /api/admin · 403 returned · Alert fired·[INFO] Wireshark PCAP capture · eth0 · 12,441 packets · Saved·[INFO] System status · LEARNING · BUILDING · AVAILABLE FOR SOC ROLES·[INFO] GPO applied · homecorp.local · Password policy · min 12 chars·[ALERT] Nikto scan from KALI01 · WEB01 · Wazuh alert · Severity: High·