◎
SOC & SIEM engineering
Security monitoring, log analysis, alert triage, dashboards, custom decoders, and correlation rules.
0xD3F4LT / CYBERSECURITY
Follow the trace.
Find the story.
Yousef Khalaf — SOC Analyst & Cyber Analyst
Investigating threats, building security tools, and sharing what I learn through training and research.
0xD3F4LT
SECURITY · RESEARCH · EDUCATION↓
01 / THE PERSON
From security signals
to actionable insight.
I'm a cybersecurity professional with hands-on experience in SOC analysis, security monitoring, incident response, SIEM engineering, threat intelligence, digital forensics, and network security.
My work spans SIEM dashboards, custom decoders, correlation rules, alert triage, and investigations guided by MITRE ATT&CK. I also deploy threat intelligence infrastructure, deliver practical SOC training, and author CTF challenges in digital forensics, cryptography, and miscellaneous categories.
02 / AREAS OF FOCUS
Detect. Investigate.
Share the knowledge.
Defensive security grounded in practical investigations, engineering, and hands-on learning.
⌕
Incident response & DFIR
Incident investigations, digital evidence, PCAP analysis, and attack-chain analysis using MITRE ATT&CK.
⌘
Threat intelligence
OpenCTI deployment, intelligence connectors, STIX relationships, indicators, observables, and TTPs.
⚑
Training & CTF authoring
Practical blue team labs, SOC mentoring, and advanced forensics, cryptography, and Misc challenges.
03 / EXPERIENCE
Experience.
In the field.
From investigating alerts to helping others
build their first
blue team workflows.
TECHNICAL TOOLKIT
SplunkELK / ElasticsearchOpenCTIMITRE ATT&CKWiresharkNmapPythonLinuxDockerKubernetes fundamentalsRedisRabbitMQMinIOThreat huntingSecurity reporting
SOC Analysis Trainer
Freelance
Deliver hands-on SOC training in log analysis, SIEM monitoring, incident detection, and alert triage. Design labs covering PCAP analysis, malware indicators, attack chains, and incident response. Collaborate with ZU, IU, Jordan Cyber Club, and Scalax on customized defensive security programs.SOC Analysis
Scan Wave
Configured SIEM dashboards, custom decoders, and correlation rules. Analyzed alerts and performed incident response using MITRE ATT&CK, with dashboards supporting real-time threat visibility.BTL1 practical training
Tuned Application · Amman
Practical training in security fundamentals, threat intelligence, phishing analysis, and digital forensics, including structured response exercises and forensic investigations.CTF Player & Challenge Author
Multiple first-place competition rankings. Create advanced Digital Forensics, Cryptography, and Misc challenges centered on realistic scenarios and analytical thinking.04 / SELECTED PROJECTS
The case
files.
Security platforms, automation, and analysis tools developed through practical work.
FILE / 001MAR 2026 / THREAT INTELLIGENCEOpenCTI Threat Intelligence Platform
Deployed and configured a Docker-based CTI environment with Elasticsearch, Redis, RabbitMQ, and MinIO. Connected threat feeds including AlienVault OTX and VirusTotal, working with STIX intelligence relationships and indicators.
FILE / 002MAY 2025 / SECURITY SIMULATIONSecureTheSystem
An interactive red/blue team training environment for incident response. Integrated Splunk and MITRE Navigator, with detection rules for SSH brute force, reverse shells, and plugin RCE attacks.
View project ↗FILE / 003AUG 2025 / SECURITY AUTOMATIONPortScannerXBot
A Python and Nmap Telegram bot for port scanning and service detection. Includes CVE suggestions based on version fingerprinting, GeoIP and WhoIs lookups, with documented API and zero-trust mitigation practices.
View project ↗FILE / 004AUG 2025 / NETWORK FORENSICSPCAP Network Traffic Analysis Tool
A GUI analysis tool supporting 100+ protocols, including IoT and ICS. Combines packet filtering, protocol search, traffic visualization, suspicious-pattern detection, and file extraction, with PCAP, CSV, and JSON workflows.
View project ↗05 / RESEARCH & PUBLICATIONS
Research.
Made public.
Research spanning intelligent threat detection and cryptography.
2026 / VOL. 16 · ISSUE 4 · PP. 317–327
LLM-WAF: An Intelligent Web Application Firewall Powered by Large Language Models for Advanced Threat Detection
International Journal of Wireless and Microwave Technologies · Yousef Khalaf
LLM-powered semantic analysis of HTTP traffic, using BERT-based NLP, PyTorch, Hugging Face Transformers, threat scoring, and adaptive learning concepts.DOI: 10.5815/ijwmt.2026.04.18Read publication ↗
2025 / VOL. 17 · ISSUE 4 · PP. 10–19
An Effective Encryption Algorithm Based on RSA and DES
International Journal of Communication Networks and Information Security · Khalaf et al.
Research combining RSA public-key cryptography and DES symmetric encryption, with comparative evaluation of security and computational considerations.Read publication ↗06 / EDUCATION & DEVELOPMENT
A strong foundation.
Continuous growth.
2021 — 2025 / ZARQA UNIVERSITY
Bachelor of Cyber Security
87.3 · ExcellentComputer Networks & Information Security, Ethical Hacking, Network Defense, Incident Response, and Security Fundamentals.
COMPLETED / TRAINING & CERTIFICATIONS
- eCIR & Security+ training Net Rider Academy · 2025
- Linux+ TeraCourse · 2025
- SIEM 101 / SOC Analyst Path / SIEM Engineer Let’s Defend · 2025
- Malware Analysis Let’s Defend · March 2025
- ICIP September 2025
- Trust and Security with Google Cloud 2024
- Digital Forensics, OSINT & Dark Web BT Labs · 2024
IN PROGRESS
CDSA · Hack The Box
Security+ · CompTIA
eCIR · INE
07 / KEEP THE CONNECTION
Curiosity is better
when it's shared.
Let’s connect on security, training, or research.
Zarqa, Jordan
· Arabic / English