hi — i'm oj.

what this is

this site documents security workflows i've built, tested, and deployed. from cloud forensics setups to threat hunting playbooks to incident response patterns. everything here is practical, repeatable, and grounded in real work.

i write for security practitioners who need to implement something tomorrow, not read theory. if you're setting up detection infrastructure, analyzing suspicious activity, or building IR workflows, this is your resource.

how i approach it

• show the full picture. explain the context, walk through configuration, verify it works.
• document decisions. trade-offs, gotchas, and why i chose one approach over another.
• make it repeatable. if a teammate can't run this tomorrow, it's not ready.

what you'll find

email security — authentication controls (SPF, DKIM, DMARC), phishing analysis, evidence preservation

cloud & identity — Azure forensics, container workflows, least-privilege patterns

detection engineering — honeypot setups, log aggregation pipelines, alert tuning

incident response — PCAP analysis, malware triage, repeatable investigation workflows

most posts work standalone. when a sequence helps, i link them. every post includes working examples and the reasoning behind them.

currently working on

• refining detection rules to maximize signal and minimize false positives
• building agent-assisted IR workflows to reduce manual triage time
• expanding cloud forensics coverage (AWS, GCP alongside Azure)