Cloud & Cybersecurity
A security practice, mapped from what runs to what is next. Everything filled is running today — on-prem controls, a Windows domain in Microsoft's cloud, and a lab where I attack my own network to see what the detection catches. Everything outlined is where this is going, picked for where blue-team and cloud-security work is actually hiring.
Entra hybrid
Conditional Access
Intune Autopilot
Purview DLP
Azure VPN + TLS
OPNsense
Netbird
Vaultwarden
Pi-hole
Splunk SIEM
Wireshark
Hardened RDP
PBS backup
Detection loop
Sentinel
Defender XDR
Wazuh + FIM
Suricata
802.1X NAC
Purple team
Sigma rules
Hover or tap a cell
The map is the point. Filled cells are built and running; the one amber cell is a loop I practise rather than leave standing; outlined cells are next. Pick any cell to read what it is.
Entra hybrid identity Entra Connect syncs the on-prem directory up; a Graph SDK script finds and removes the duplicate objects the wizard leaves behind. shipped Conditional Access MFA required and risky countries blocked — watched in report-only until the policy was known to be right, then enforced. shipped Intune + Autopilot A laptop goes from the box to a compliant, signed-in desktop with required apps — and no hands from IT. shipped Purview compliance DLP over mail, files and chat; retention by age; litigation hold that survives whatever the user does. shipped Azure VPN + TLS Point-to-site VPN bound to certificates, and an IIS site on an Azure VM with a free ACME certificate and HTTPS enforced. shipped OPNsense isolation A virtual firewall carving an isolated lab segment — outbound-only internet, drop by default toward the parent network. shipped Netbird zero-trust The whole LAN reachable over a WireGuard overlay. Nothing listens on the open internet; there is no port to attack. shipped Vaultwarden / Cloudflare Tunnel A self-hosted password vault reachable over HTTPS from anywhere — no public IP, no open port, no reverse proxy. shipped Pi-hole DNS sink Network-wide DNS filtering. Known-bad names never resolve for anything on the LAN — the cheapest control that keeps paying. shipped Splunk SIEM Splunk with a Universal Forwarder on the domain controller — Security, System and Application logs, searchable. shipped Wireshark analysis Ground truth on the wire: what actually crossed, in what order, when the logs alone do not settle it. shipped Hardened Remote Desktop RDP off the default port, NLA on, restricted by group, and reachable only over the overlay — with the reasons not to expose it. shipped PBS append-only backup Proxmox Backup Server behind an append-only token and tested by restore drill. Ransomware cannot delete what it cannot reach. shipped Project Z — the detection loop Kali attacks, OPNsense logs, Wireshark confirms what crossed the wire, Splunk alerts. Practised end to end, not left running. practised Microsoft Sentinel A cloud-native SIEM and SOAR over the M365 and Azure logs — KQL analytics rules and automated response playbooks. next Defender XDR Defender for Endpoint, Identity and Cloud correlated into one incident queue instead of four separate consoles. next Wazuh + file-integrity monitoring An agent on every VM and LXC: file-integrity monitoring, CIS benchmarks scored nightly, and a dashboard for what drifted. next Suricata IDS/IPS Inline intrusion detection on the firewall, rules tuned to the lab, alerts forwarded straight into the SIEM. next 802.1X network access control Port-based access control: a device authenticates to the switch before it is handed a VLAN. Written as an SOP before it goes live. next Purple-team against my own AD Kerberoasting, AS-REP roasting and NTLM relay practised on the isolated segment — with the detection that caught each one, or did not. next Detection-as-code (Sigma) Portable detection rules written once and deployed to any SIEM, version-controlled and reviewed like code. next The paper behind the map
✓ CompTIA Network+✓ CompTIA Security+✓ Cisco CCNA✓ Microsoft AZ-900→ CISSPHeld: CompTIA Network+ · CompTIA Security+ · Cisco CCNA · Microsoft AZ-900. Next on the ladder: CISSP. The lab came first — the paper sits on top of the hands-on, not instead of it.