Sumeer Singh Rana SOC Analyst · Security Engineer · MSc Computing

Automated open-source intelligence for SOC analysts. Enter any IP, domain, or URL and get a complete investigation report in one click — the same lookups an analyst runs manually in 10–15 minutes, done in seconds.

• MITRE ATT&CK auto-tagging — every finding mapped to a specific technique with a plain-English reason
• Campaign correlation engine — clusters related IOCs by shared ASN, registrar, nameserver, or registration week
• Ticket-ready PDF reports with risk indicators and recommendations

Mini-SIEM that parses SSH auth, web access, and Windows Security Event logs — detecting 9 attack patterns, every alert mapped to MITRE ATT&CK.

• Correlation engine — chains alerts into incidents like "brute force → lockout → admin privileges = full domain compromise"
• GeoIP enrichment + environment risk score (0–100)
• Real-time watch mode tails live logs and fires alerts as attacks happen

ML classifier that detects phishing URLs from URL text alone — no network calls, instant offline predictions. Trained on 2,072 labelled URLs.

• 24 lexical features — abused-TLD detection, punycode lookalikes, IP-as-hostname, subdomain depth
• Flask web UI + JSON API for integration with other tools

SOC-grade credential tool for post-incident vault auditing — check dumped hashes against HIBP without ever sending the full hash.

• Cross-vault pattern detection — finds template reuse, base-word reuse, keyboard walks
• PDF executive health report with pattern risk score; imports Bitwarden / Chrome / 1Password / LastPass

Cloud security posture monitoring that scores AWS, Azure, and GCP on latency, cost, availability, and security — with misconfiguration and drift detection, severity classification, and automated PDF reporting.

REST API implementing JWT authentication, token blacklisting, three-tier RBAC (admin / operator / viewer), and full audit logging — core IAM and least-privilege principles applied end to end.

Built for the CAMP Cybersecurity Mentorship Program. Automates all HPING3 scan types, classifies each port as OPEN / CLOSED / FILTERED / EVADED, and auto-generates a PDF report.

Simulation of an industrial control system under cyber-attack, using a five-state security state machine with real-time scheduling and automated fail-safe mitigation. Bridges ECE hardware background with cybersecurity.