Piotr Szkudlarek

SOC Analyst L1

SIEM · detection engineering · Python automation

I analyze alerts in a SOC, configure a SIEM based on Elastic/OpenSearch and automate my work in Python. I built Mini-SOAR, my own alert enrichment engine.

Projects Contact

Projects & case studies

Project 01

Mini-SOAR

Alert enrichment and threat hunting in Python

Enriches new alerts as they come in - risk level, recommended steps, the reasoning behind security findings, mapping to MITRE ATT&CK
Hourly threat hunting across all Windows/AD logs: detects password spraying, Kerberoasting, DCSync and other attack techniques
VPN session attribution and the user account analyzer with an HTML report

Input

new Windows alerts in the SIEM (OpenSearch)
Windows and Active Directory events
VPN gateway logs

Engine (Python)

every 90 s - enrichment
hourly - threat hunting

01alert parser
02targeted context queries
03per-event-type analysis module
04SigmaHQ rules (pySigma)
05verdict: risk, rationale, MITRE ATT&CK

SQLite · systemd - state, retries, backlog

Output

enriched alert
hunting findings, without hourly duplicates
HTML report for an account or event type (PowerShell script)

Read the case study

Project 02

User account analyzer

An account activity report from correlated logs, with hypotheses of possible compromise and their justification

An HTML report of an account: a concise security verdict, risk score and recommendation
Hypotheses with evidence straight from the SIEM, MITRE ATT&CK links and an L1 checklist
Comparison with the same account’s baseline of previous days, VPN session correlation, a timeline of all events

Part of the analyzer report: a verdict with a risk score and a password spraying hypothesis (synthetic data).

Read the case study

Project 03

VirusTotal enrichment

OSINT on IP addresses from Cloudflare alerts, written back to the SIEM

A Python script takes the IP address from Cloudflare alerts, gathers public information about it from VirusTotal and writes it back to the alert
Each alert is checked only once, and only public addresses go to VirusTotal
Python, Query DSL, VirusTotal API v3, cron

Fields added to the alert - synthetic example

{
  "virustotal": {
    "ISP_name": "LAB-EXAMPLE-AS",
    "Country": "ZZ",
    "Reputation": -12,
    "Malicious": 7,
    "FlaggedBy": "EngineA,EngineB,EngineC"
  }
}

Read the case study

Project 04

Automated shift report

A standardized work report for every shift

Automatically detects the current shift’s time range and pulls its data from the SIEM
Groups alerts by rule and lists their most important details
Fills in a standardized report template, including text boxes, headers and footers

Rule list in the report - synthetic example

• WAF – reguła przykładowa A: 12: 8x [szczegół 1], 4x [szczegół 2]
• Windows – reguła przykładowa B: 4: 3x logon - lab-user01, 1x logon - lab-user02
• Windows – reguła przykładowa C: 2: 2x lab-admin01

Read the case study

Work experience

SOC Analyst L1
Komputronik Biznes
- triaging and analyzing SIEM and EDR alerts - including Windows/AD, Cloudflare WAF, VPN, Office 365 and network traffic
- building Python tools that support the whole SOC team: my own Mini-SOAR engine, alert enrichment and report generation
- making threat hunting easier with the Mini-SOAR and user account analyzer modules, which help find threats and analyze correlated account activity
04.2026 – presentDetails
IT/OT Systems Implementation Specialist
Mikronika
- handling incidents with SCADA systems - verifying them on my own, analyzing root causes and escalating with a recommendation based on the data collected
- monitoring systems in Grafana and PRTG, with alert configuration and analysis of application and system logs
- building an Excel/VBA tool, supported by Python, that tracked nearly 1,000 helpdesk tickets - ticket statuses, SLA and KPIs
05.2025 – 03.2026Details
Junior Data Analyst
Santander
- analyzing operational and user data in an AML/CTF-regulated environment
- detecting anomalies in data and assessing its quality
- reporting results in Excel and working with other teams
07.2024 – 04.2025Details