Hybrid edge-to-cloud SSH honeypot pipeline. A Cowrie honeypot at the network edge captured real-world attacks over a 14-day run, shipped logs through a serverless AWS pipeline, and rendered attack telemetry in a React dashboard. The AWS pipeline and dashboard remain live; the edge sensor has been decommissioned after its collection run.
Pi 5 (k3s edge worker) → VPS with Suricata IDS → S3 → Lambda pipeline → DynamoDB → API → React dashboard. Wazuh + ELK on R730 ingest the same telemetry for SIEM analysis and threat hunting.
Highlights
Multi-tier detection architecture: Cowrie SSH honeypot on Raspberry Pi 5 (edge) → VPS ingress with Suricata IDS → on-prem SIEM core (Wazuh + Elastic Stack on Dell R730) → AWS-native correlation pipeline. Real attack surface, home network IP private.
Captured live botnet activity — Mirai credential markers (345gs5662d34), SSH-key implant persistence, crypto-mining reconnaissance, and automated Go / libssh scanners. Top origins: Netherlands, Uzbekistan, United States (374 IPs), Hong Kong, Germany. Raw events archived to S3; correlated + GeoIP-enriched in DynamoDB.
Multi-source ingestion pipeline: MLB Stats API for game/player/team data, Baseball Savant CSV leaderboards for Statcast metrics (exit velocity, barrel %, xwOBA, bat tracking, pitcher arsenal). Daily EventBridge crons orchestrate idempotent batch updates with per-source failure isolation.
AI inference layer: Amazon Bedrock integration generates player and team analysis with read-through DynamoDB cache and quota-aware fallback handling.
18 Lambda functions: spread across data ingestion, API serving, AI inference, and WebSocket connection management. All on a single-table DynamoDB design.
Frontend performance: React with code splitting — Lighthouse 87 desktop / 90 mobile in production. CI/CD on push to main; 305 backend + 225 frontend tests in CI.
Self-hosted security operations environment, services platform, and continuous-deployment target. Real workloads on real hardware — used to deepen hands-on networking, security, and infrastructure skills beyond what cloud-only environments offer.
Network Topology
Internet → PA-440 firewall → CBS350 switch (VLAN-segmented) → Pi 5 edge / R730 hypervisor / lab segment
Hardware
Hypervisor Host
Dell PowerEdge R730 (iDRAC7 Enterprise)
Storage
Samsung 870 EVO / Crucial MX500 (RAID 1)
Edge Honeypot
Raspberry Pi 5
L2 Switching
Cisco CBS350-28T
Firewall
Palo Alto PA-440
Wireless
Alfa AWUS036ACS
Power
CyberPower CP1500PFCLCD UPS
What it does
SIEM core: Wazuh (manager + indexer + dashboard) + Elastic Stack (Elasticsearch + Logstash + Kibana) on the R730 Proxmox hypervisor — ingesting Cowrie honeypot telemetry from the Pi 5 sensor and Suricata IDS alerts from the VPS ingress. Custom decoders, 10+ Sigma detection rules tuned against live attacker telemetry, MITRE ATT&CK coverage.
Multi-node Kubernetes (k3s): R730 as control plane + Pi 5 as worker node. Cowrie deployed as a pod with persistent volumes. Multi-environment GitOps target alongside AWS production.
Self-hosted services on Proxmox VMs: Pi-hole DNS sinkhole, internal Git, password manager, file sync, media platform — with monitoring and scheduled backups to RAID 1 storage.
Segmented network architecture: VLANs and trunking on the Cisco CBS350-28T; inter-zone security policies and Layer 7 inspection on the Palo Alto PA-440 between management, server, lab, and edge segments. Studied advanced PAN-OS features (App-ID, Threat Prevention, URL Filtering) via the Palo Alto NGFW Academy lab environment.
Wireless security testing on a dedicated lab SSID using the Alfa AWUS036ACS in monitor mode; manage the R730 remotely via iDRAC (remote console, power cycling, OS-down recovery).