Repository navigation
Expand file tree
/
Copy pathindex.html
More file actions
363 lines (330 loc) · 24.6 KB
/
Copy pathindex.html
File metadata and controls
363 lines (330 loc) · 24.6 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>SentinelLab | Specific SOC Environment</title>
<script src="https://cdn.tailwindcss.com"></script>
<link href="https://fonts.googleapis.com/css2?family=Fira+Code:wght@400;600&family=Inter:wght@400;500;700&display=swap" rel="stylesheet">
<script>
tailwind.config = {
theme: {
extend: {
fontFamily: {
mono: ['"Fira Code"', 'monospace'],
sans: ['Inter', 'sans-serif'],
},
colors: {
cyber: {
black: '#050505',
dark: '#0a0a0a',
gray: '#171717',
green: '#10b981',
greenGlow: 'rgba(16, 185, 129, 0.2)'
}
}
}
}
}
</script>
<style>
body { background-color: #050505; color: #e2e8f0; }
.cyber-card {
background: linear-gradient(180deg, #171717 0%, #0a0a0a 100%);
border: 1px solid #262626;
transition: all 0.3s ease;
}
.cyber-card-active:hover {
border-color: #10b981;
box-shadow: 0 4px 20px rgba(16, 185, 129, 0.15);
transform: translateY(-2px);
}
.text-glow { text-shadow: 0 0 10px rgba(16, 185, 129, 0.6); }
/* Subtle STATIC scanline background effect */
.scanlines {
position: fixed; top: 0; left: 0; width: 100vw; height: 100vh;
background: linear-gradient(to bottom, rgba(255,255,255,0), rgba(255,255,255,0) 50%, rgba(0,0,0,0.1) 50%, rgba(0,0,0,0.1));
background-size: 100% 4px; z-index: 50; pointer-events: none; opacity: 0.1;
}
</style>
</head>
<body class="font-sans antialiased relative overflow-x-hidden selection:bg-emerald-500 selection:text-white">
<div class="scanlines"></div>
<!-- Navigation -->
<nav class="border-b border-neutral-800 bg-cyber-black/80 backdrop-blur-md sticky top-0 z-40">
<div class="max-w-6xl mx-auto px-6 py-4 flex justify-between items-center">
<div class="font-mono font-bold text-xl text-white">
<span class="text-emerald-500">root@</span>SentinelLab:~#
</div>
<div class="hidden md:flex space-x-6 font-mono text-sm text-neutral-400">
<a href="#about" class="hover:text-emerald-400 transition-colors">./about.sh</a>
<a href="#architecture" class="hover:text-emerald-400 transition-colors">./architecture</a>
<a href="#visuals" class="hover:text-emerald-400 transition-colors">./visuals</a>
<a href="#writeups" class="hover:text-emerald-400 transition-colors">./writeups</a>
<a href="#roadmap" class="hover:text-emerald-400 transition-colors">./roadmap</a>
</div>
</div>
</nav>
<!-- Hero Section -->
<header class="max-w-6xl mx-auto px-6 py-20 mt-8" id="about">
<div class="inline-block px-3 py-1 mb-6 border border-emerald-900 bg-emerald-900/20 text-emerald-400 font-mono text-xs rounded-full">
● STATUS: ONLINE _
</div>
<h1 class="text-5xl md:text-6xl font-bold tracking-tight mb-6">
Production-Style <span class="text-emerald-500 text-glow">SOC Detection Lab.</span>
</h1>
<p class="text-lg text-neutral-400 max-w-2xl mb-10 leading-relaxed">
Engineered around a segmented multi-tier enterprise architecture featuring an edge OPNsense firewall, a dedicated DMZ with a vulnerable OWASP shop web application for initial entry, isolated Clients & Servers LANs, and full telemetry ingested directly into a centralized SIEM Stack.
</p>
<!-- Stats Grid -->
<div class="grid grid-cols-2 md:grid-cols-4 gap-4 font-mono">
<div class="cyber-card p-4 rounded-lg">
<div class="text-neutral-500 text-xs mb-1">// NETWORK ZONES</div>
<div class="text-2xl text-white font-semibold">3 Subnets</div>
</div>
<div class="cyber-card p-4 rounded-lg">
<div class="text-neutral-500 text-xs mb-1">// ENTRY POINT</div>
<div class="text-2xl text-white font-semibold">OWASP App</div>
</div>
<div class="cyber-card p-4 rounded-lg">
<div class="text-neutral-500 text-xs mb-1">// SIEM CORE</div>
<div class="text-2xl text-white font-semibold">Splunk Ent.</div>
</div>
<div class="cyber-card p-4 rounded-lg">
<div class="text-neutral-500 text-xs mb-1">// ARCHITECTURE</div>
<div class="text-2xl text-white font-semibold">v3.0</div>
</div>
</div>
</header>
<!-- Lab Architecture Section -->
<section id="architecture" class="max-w-6xl mx-auto px-6 py-16">
<h2 class="text-2xl font-mono text-white mb-8 border-b border-neutral-800 pb-4">
<span class="text-emerald-500 mr-2">></span>Lab_Infrastructure.yaml
</h2>
<p class="text-neutral-400 mb-10 leading-relaxed">
This infrastructure isolates external traffic, DMZ exposure, internal workstations, and core server infrastructure. Telemetry across all hosts and firewall boundaries is continuously streamed into the SIEM Stack.
</p>
<div class="grid md:grid-cols-2 xl:grid-cols-3 gap-6">
<!-- 1. OPNsense Firewall -->
<div class="cyber-card cyber-card-active p-8 rounded-xl relative overflow-hidden group">
<div class="absolute top-0 right-0 p-4 font-mono text-xs text-emerald-500 opacity-50">ACTIVE</div>
<h3 class="text-xl font-bold text-white mb-3">OPNsense Firewall</h3>
<p class="text-neutral-400 text-sm mb-4">The core network perimeter. Manages routing, traffic filtering, and stateful inspection across WAN (Internet), DMZ, Clients LAN, and Servers LAN while streaming firewall syslogs to the SIEM.</p>
<div class="flex flex-wrap gap-2">
<span class="px-2 py-1 bg-neutral-900 border border-neutral-800 rounded text-xs text-neutral-400 font-mono">Perimeter</span>
<span class="px-2 py-1 bg-neutral-900 border border-neutral-800 rounded text-xs text-neutral-400 font-mono">Routing</span>
<span class="px-2 py-1 bg-neutral-900 border border-neutral-800 rounded text-xs text-neutral-400 font-mono">Syslog</span>
</div>
</div>
<!-- 2. Kali Linux Machine -->
<div class="cyber-card cyber-card-active p-8 rounded-xl relative overflow-hidden group">
<div class="absolute top-0 right-0 p-4 font-mono text-xs text-emerald-500 opacity-50">ACTIVE</div>
<h3 class="text-xl font-bold text-white mb-3">Kali Machine</h3>
<p class="text-neutral-400 text-sm mb-4">External attacker node positioned across the WAN. Executes initial recon, web application exploits against the DMZ target, payload delivery, and subsequent internal pivot execution.</p>
<div class="flex flex-wrap gap-2">
<span class="px-2 py-1 bg-neutral-900 border border-neutral-800 rounded text-xs text-neutral-400 font-mono">Offensive</span>
<span class="px-2 py-1 bg-neutral-900 border border-neutral-800 rounded text-xs text-neutral-400 font-mono">External WAN</span>
</div>
</div>
<!-- DMZ Zone Label -->
<div class="col-span-1 md:col-span-2 xl:col-span-3 mt-4">
<h4 class="text-lg font-mono text-neutral-400 mb-2 px-4 py-2 bg-neutral-900 rounded-lg border border-neutral-800 flex items-center justify-between">
<span>:: DMZ.zone</span>
<span class="text-xs text-amber-500 font-mono">ATTACK ENTRY PERIMETER</span>
</h4>
</div>
<!-- 3. Linux Web Server (OWASP Shop) -->
<div class="cyber-card cyber-card-active p-8 rounded-xl relative overflow-hidden group col-span-1 md:col-span-2 xl:col-span-3 border-amber-900/50">
<div class="absolute top-0 right-0 p-4 font-mono text-xs text-amber-400">ENTRY POINT</div>
<h3 class="text-xl font-bold text-white mb-3">Linux Web Server (Vulnerable OWASP Shop)</h3>
<p class="text-neutral-400 text-sm mb-4">
Positioned in the DMZ as the primary foothold target. Hosts an intentionally vulnerable OWASP shop application exposed to the WAN for web exploit simulations (e.g., SQLi, RCE, Broken Auth). Configured with auditd and forwarders to send full web and system logs to the SIEM.
</p>
<div class="flex flex-wrap gap-2">
<span class="px-2 py-1 bg-amber-950/40 border border-amber-800 rounded text-xs text-amber-300 font-mono">OWASP Shop</span>
<span class="px-2 py-1 bg-neutral-900 border border-neutral-800 rounded text-xs text-neutral-400 font-mono">Initial Access</span>
<span class="px-2 py-1 bg-neutral-900 border border-neutral-800 rounded text-xs text-neutral-400 font-mono">DMZ Host</span>
<span class="px-2 py-1 bg-neutral-900 border border-neutral-800 rounded text-xs text-neutral-400 font-mono">Splunk UF</span>
</div>
</div>
<!-- Clients LAN Zone Label -->
<div class="col-span-1 md:col-span-2 xl:col-span-3 mt-4">
<h4 class="text-lg font-mono text-neutral-400 mb-2 px-4 py-2 bg-neutral-900 rounded-lg border border-neutral-800">:: CLIENTS_LAN.zone</h4>
</div>
<!-- 4. Windows 11 Client -->
<div class="cyber-card cyber-card-active p-8 rounded-xl relative overflow-hidden group col-span-1 md:col-span-2 xl:col-span-3">
<div class="absolute top-0 right-0 p-4 font-mono text-xs text-emerald-500 opacity-50">ACTIVE</div>
<h3 class="text-xl font-bold text-white mb-3">Windows 11 Workstation</h3>
<p class="text-neutral-400 text-sm mb-4">Internal corporate client endpoint domain-joined to Active Directory. Target for post-exploitation pivots from the compromised DMZ, privilege escalation, and lateral movement. Monitored with Sysmon and Splunk Universal Forwarder.</p>
<div class="flex flex-wrap gap-2">
<span class="px-2 py-1 bg-neutral-900 border border-neutral-800 rounded text-xs text-neutral-400 font-mono">Windows 11</span>
<span class="px-2 py-1 bg-neutral-900 border border-neutral-800 rounded text-xs text-neutral-400 font-mono">Sysmon</span>
<span class="px-2 py-1 bg-neutral-900 border border-neutral-800 rounded text-xs text-neutral-400 font-mono">Endpoint Telemetry</span>
</div>
</div>
<!-- Servers LAN Zone Label -->
<div class="col-span-1 md:col-span-2 xl:col-span-3 mt-4">
<h4 class="text-lg font-mono text-neutral-400 mb-2 px-4 py-2 bg-neutral-900 rounded-lg border border-neutral-800">:: SERVERS_LAN.zone</h4>
</div>
<!-- 5. Domain Controller -->
<div class="cyber-card cyber-card-active p-8 rounded-xl relative overflow-hidden group">
<div class="absolute top-0 right-0 p-4 font-mono text-xs text-emerald-500 opacity-50">ACTIVE</div>
<h3 class="text-xl font-bold text-white mb-3">Domain Controller (AD DS)</h3>
<p class="text-neutral-400 text-sm mb-4">Core identity provider handling Active Directory domain services, Kerberos authentication, and group policy objects. Central target for credential harvesting, DCSync, and lateral attack paths.</p>
<div class="flex flex-wrap gap-2">
<span class="px-2 py-1 bg-neutral-900 border border-neutral-800 rounded text-xs text-neutral-400 font-mono">Active Directory</span>
<span class="px-2 py-1 bg-neutral-900 border border-neutral-800 rounded text-xs text-neutral-400 font-mono">Security Logs</span>
</div>
</div>
<!-- 6. SIEM Stack -->
<div class="cyber-card cyber-card-active p-8 rounded-xl relative overflow-hidden group">
<div class="absolute top-0 right-0 p-4 font-mono text-xs text-emerald-500 opacity-50">ACTIVE</div>
<h3 class="text-xl font-bold text-white mb-3">SIEM Stack (Splunk Enterprise)</h3>
<p class="text-neutral-400 text-sm mb-4">Centralized SOC ingestion and detection engine. Aggregates telemetry across OPNsense, the DMZ OWASP web server, Windows 11 endpoint, and Domain Controller for unified correlation.</p>
<div class="flex flex-wrap gap-2">
<span class="px-2 py-1 bg-neutral-900 border border-neutral-800 rounded text-xs text-neutral-400 font-mono">Splunk Enterprise</span>
<span class="px-2 py-1 bg-neutral-900 border border-neutral-800 rounded text-xs text-neutral-400 font-mono">Detection SIEM</span>
</div>
</div>
</div>
</section>
<!-- Project Screenshots -->
<section id="visuals" class="max-w-6xl mx-auto px-6 py-16">
<h2 class="text-2xl font-mono text-white mb-8 border-b border-neutral-800 pb-4">
<span class="text-emerald-500 mr-2">></span>_Visuals.img
</h2>
<div class="grid grid-cols-1 md:grid-cols-2 gap-6">
<!-- 01. Architecture Visualization (Full Width / Featured) -->
<a href="images/Architecture-Visualization.png" target="_blank" rel="noopener noreferrer" class="md:col-span-2 block">
<div class="group relative rounded-lg overflow-hidden border border-neutral-800 cyber-card cyber-card-active aspect-video">
<img src="images/Architecture-Visualization.png" alt="Lab Architecture Overview" class="w-full h-full object-cover opacity-60 group-hover:opacity-100 transition-opacity duration-300 filter grayscale group-hover:grayscale-0">
<div class="absolute bottom-0 left-0 w-full bg-black/80 backdrop-blur-sm p-4 border-t border-neutral-800 font-mono text-sm text-neutral-300">
01_soc_network_architecture_diagram.png
</div>
</div>
</a>
<!-- 02. OWASP Shop Vulnerable Target (4:3) -->
<a href="images/Vulnerable-OwaspShop.png" target="_blank" rel="noopener noreferrer" class="block">
<div class="group relative rounded-lg overflow-hidden border border-neutral-800 cyber-card cyber-card-active aspect-[4/3]">
<img src="images/Vulnerable-OwaspShop.png" alt="Vulnerable OWASP Juice Shop Application" class="w-full h-full object-cover opacity-60 group-hover:opacity-100 transition-opacity duration-300 filter grayscale group-hover:grayscale-0">
<div class="absolute bottom-0 left-0 w-full bg-black/80 backdrop-blur-sm p-4 border-t border-neutral-800 font-mono text-sm text-neutral-300">
02_vulnerable_owaspshop.png
</div>
</div>
</a>
<!-- 03. OPNsense Dashboard (16:10) -->
<a href="images/OPNsense-Dashboard.png" target="_blank" rel="noopener noreferrer" class="block">
<div class="group relative rounded-lg overflow-hidden border border-neutral-800 cyber-card cyber-card-active aspect-[16/10]">
<img src="images/OPNsense-Dashboard.png" alt="OPNsense Firewall Dashboard" class="w-full h-full object-cover opacity-60 group-hover:opacity-100 transition-opacity duration-300 filter grayscale group-hover:grayscale-0">
<div class="absolute bottom-0 left-0 w-full bg-black/80 backdrop-blur-sm p-4 border-t border-neutral-800 font-mono text-sm text-neutral-300">
03_opnsense_dashboard.png
</div>
</div>
</a>
<!-- 04. OPNsense Rules / Firewall Matrix (Ultrawide 21:9) -->
<a href="images/OPNsense_Rules.png" target="_blank" rel="noopener noreferrer" class="md:col-span-2 block">
<div class="group relative rounded-lg overflow-hidden border border-neutral-800 cyber-card cyber-card-active aspect-[21/9]">
<img src="images/OPNsense_Rules.png" alt="OPNsense Firewall Rules Matrix" class="w-full h-full object-cover opacity-60 group-hover:opacity-100 transition-opacity duration-300 filter grayscale group-hover:grayscale-0">
<div class="absolute bottom-0 left-0 w-full bg-black/80 backdrop-blur-sm p-4 border-t border-neutral-800 font-mono text-sm text-neutral-300">
04_opnsense_rules_matrix.png
</div>
</div>
</a>
<!-- 05. OPNsense Console / Screen Capture (Standard 16:9) -->
<a href="images/OPNsense_scrn.png" target="_blank" rel="noopener noreferrer" class="md:col-span-2 block">
<div class="group relative rounded-lg overflow-hidden border border-neutral-800 cyber-card cyber-card-active aspect-video">
<img src="images/OPNsense_scrn.png" alt="OPNsense Interface & Console State" class="w-full h-full object-cover opacity-60 group-hover:opacity-100 transition-opacity duration-300 filter grayscale group-hover:grayscale-0">
<div class="absolute bottom-0 left-0 w-full bg-black/80 backdrop-blur-sm p-4 border-t border-neutral-800 font-mono text-sm text-neutral-300">
05_opnsense_console_screen.png
</div>
</div>
</a>
</div>
</section>
<!-- Upcoming Write-ups Section -->
<section id="writeups" class="max-w-6xl mx-auto px-6 py-16">
<h2 class="text-2xl font-mono text-white mb-8 border-b border-neutral-800 pb-4">
<span class="text-emerald-500 mr-2">></span>ls -la ./writeups
</h2>
<p class="text-neutral-400 mb-10 leading-relaxed">Detailed technical documentation of attack chains, detection engineering (SPL queries), and incident response playbooks simulated within the lab.</p>
<div class="grid md:grid-cols-2 lg:grid-cols-3 gap-6">
<!-- Write-up 1 -->
<div class="cyber-card p-6 rounded-xl relative overflow-hidden border-dashed border-neutral-700 opacity-75">
<div class="absolute top-0 right-0 p-4 font-mono text-xs text-neutral-500">WIP</div>
<h3 class="text-xl font-bold text-neutral-300 mb-2">Initial Foothold: OWASP Shop</h3>
<p class="text-neutral-500 text-sm mb-6">Exploiting vulnerable web endpoints on the DMZ Linux server to gain initial shell access and correlating web server access logs with SIEM alerts.</p>
<div class="flex items-center justify-between mt-auto">
<span class="px-2 py-1 bg-neutral-900 border border-neutral-800 rounded text-xs text-neutral-500 font-mono">T1190</span>
<button disabled class="px-4 py-2 bg-neutral-900/50 text-neutral-500 border border-neutral-800 rounded text-xs font-mono cursor-not-allowed">
COMING SOON
</button>
</div>
</div>
<!-- Write-up 2 -->
<div class="cyber-card p-6 rounded-xl relative overflow-hidden border-dashed border-neutral-700 opacity-75">
<div class="absolute top-0 right-0 p-4 font-mono text-xs text-neutral-500">WIP</div>
<h3 class="text-xl font-bold text-neutral-300 mb-2">DMZ to Clients LAN Pivot</h3>
<p class="text-neutral-500 text-sm mb-6">Pivoting from the compromised DMZ web server into the internal network, targeting the Windows 11 workstation and detecting SMB/RDP movement.</p>
<div class="flex items-center justify-between mt-auto">
<span class="px-2 py-1 bg-neutral-900 border border-neutral-800 rounded text-xs text-neutral-500 font-mono">T1021.002</span>
<button disabled class="px-4 py-2 bg-neutral-900/50 text-neutral-500 border border-neutral-800 rounded text-xs font-mono cursor-not-allowed">
COMING SOON
</button>
</div>
</div>
<!-- Write-up 3 -->
<div class="cyber-card p-6 rounded-xl relative overflow-hidden border-dashed border-neutral-700 opacity-75">
<div class="absolute top-0 right-0 p-4 font-mono text-xs text-neutral-500">WIP</div>
<h3 class="text-xl font-bold text-neutral-300 mb-2">Domain Compromise & Detection</h3>
<p class="text-neutral-500 text-sm mb-6">Harvesting Active Directory credentials, compromising the Domain Controller, and building Splunk correlation rules for Kerberos anomalies.</p>
<div class="flex items-center justify-between mt-auto">
<span class="px-2 py-1 bg-neutral-900 border border-neutral-800 rounded text-xs text-neutral-500 font-mono">T1558.001</span>
<button disabled class="px-4 py-2 bg-neutral-900/50 text-neutral-500 border border-neutral-800 rounded text-xs font-mono cursor-not-allowed">
COMING SOON
</button>
</div>
</div>
</div>
</section>
<!-- Progress Tracker / Roadmap -->
<section id="roadmap" class="max-w-3xl mx-auto px-6 py-16 mb-20">
<h2 class="text-2xl font-mono text-white mb-10 border-b border-neutral-800 pb-4 text-center">
<span class="text-emerald-500 mr-2">tail -f</span>roadmap.log
</h2>
<div class="relative border-l-2 border-neutral-800 ml-4 md:ml-0 md:pl-8 space-y-12">
<!-- Phase 1 -->
<div class="relative pl-8 md:pl-0">
<div class="absolute -left-10 md:-left-[2.35rem] top-1 h-5 w-5 rounded-full bg-emerald-500 border-4 border-cyber-black flex items-center justify-center"></div>
<div class="font-mono text-xs text-emerald-500 mb-2">[ ✔ ] PHASE 1 : COMPLETE</div>
<h3 class="text-lg font-bold text-white mb-2">Network Segmentation & Firewall Setup</h3>
<p class="text-neutral-400 text-sm">Deployment of OPNsense firewall with multi-tier routing across WAN, DMZ, Clients LAN, and Servers LAN.</p>
</div>
<!-- Phase 2 -->
<div class="relative pl-8 md:pl-0">
<div class="absolute -left-10 md:-left-[2.35rem] top-1 h-5 w-5 rounded-full bg-emerald-500 border-4 border-cyber-black flex items-center justify-center"></div>
<div class="font-mono text-xs text-emerald-500 mb-2">[ ✔ ] PHASE 2 : COMPLETE</div>
<h3 class="text-lg font-bold text-white mb-2">Host Provisioning & Telemetry Pipeline</h3>
<p class="text-neutral-400 text-sm">Deployment of the DMZ OWASP Shop web application, Windows 11 endpoint, Domain Controller, and Splunk SIEM Stack with universal forwarder log ingestion.</p>
</div>
<!-- Phase 3 -->
<div class="relative pl-8 md:pl-0">
<div class="absolute -left-10 md:-left-[2.35rem] top-1 h-5 w-5 rounded-full bg-blue-500 border-4 border-cyber-black"></div>
<div class="font-mono text-xs text-blue-400 mb-2">[ ⟳ ] PHASE 3 : IN PROGRESS</div>
<h3 class="text-lg font-bold text-white mb-2">End-to-End Attack Emulation</h3>
<p class="text-neutral-400 text-sm">Simulating an external attack chain: Kali attacking the DMZ OWASP web application, pivoting into Clients LAN, and executing lateral movement toward the Domain Controller.</p>
</div>
<!-- Phase 4 -->
<div class="relative pl-8 md:pl-0">
<div class="absolute -left-10 md:-left-[2.35rem] top-1 h-5 w-5 rounded-full bg-neutral-700 border-4 border-cyber-black"></div>
<div class="font-mono text-xs text-neutral-500 mb-2">[ ◻ ] PHASE 4 : UPCOMING</div>
<h3 class="text-lg font-bold text-neutral-300 mb-2">Detection Engineering & Alert Correlation</h3>
<p class="text-neutral-500 text-sm">Crafting custom Splunk SPL correlation searches, mapping attack phases to MITRE ATT&CK techniques, and tuning detection dashboards.</p>
</div>
</div>
</section>
<!-- Footer -->
<footer class="border-t border-neutral-800 bg-cyber-black mt-12 py-8 text-center text-neutral-500 font-mono text-xs">
<p>SentinelLab (v3.0) © 2026 // Built for defenders. // </p>
</footer>
</body>
</html>