Computer Science student in Budapest (ELTE), learning defensive security and detection engineering.
I'm learning how attacks look in Windows telemetry and how to detect them:
- Windows Security Event Logs (4624/4625, Logon Types) and Sysmon
- Writing and testing Sigma detection rules
- Translating detections to KQL / SPL
- Mapping techniques to MITRE ATT&CK
- Alert triage and writing clear SOC-style tickets
detection-lab — a from-scratch home lab where I document detections as small, reviewable "quality packages": telemetry contract → rule → test → benign examples → MITRE mapping → KQL translation → triage notes.
Windows · Sysmon · Sigma · KQL · Elastic SIEM · Microsoft Sentinel · MITRE ATT&CK · Python · PowerShell · Linux
- Portfolio: https://cntzemir.github.io/
- Email: canitezemirr@gmail.com
- LinkedIn: https://www.linkedin.com/in/emircntz/
Note: some older repositories on this profile are archived. They reflect earlier web/AppSec experiments and are no longer my focus.