Security Engineering & Tooling
Tuning noisy insider-risk alerts and building AI-assisted investigation workflows
I improved behavioral alerting, built Python workflows for repeatable evidence collection, created an AI agent that develops SPL with the analyst, and shipped Splunk dashboards with automated updates for leadership, HR, and Legal.
Impact & Outcomes
Behavioral baseline tuning eliminated alert fatigue and reduced noisy false positives by over 80%.
Replaced brittle static signatures with contextual peer baselines and dynamic thresholds.
High-confidence anomaly triggers elevated genuine malicious behaviors for rapid triage.
Automated Splunk dashboards and Python pipelines keeping Leadership, HR, and Legal in sync.
The Challenge
Alert Fatigue & Brittle Detection Logic
Generic vendor detection rules triggered endless non-actionable alarms whenever engineers pushed code outside normal hours or cloned internal documentation, burying real insider threats in noise.
Manual Evidence Gathering Toil
Investigators spent hours manually writing repetitive SPL queries, normalizing mismatched timestamps across logs, exporting CSVs, and reformatting telemetry for executive briefings.
Engineering & Automation Architecture
01. Behavioral Detection Engineering
Refined detection logic in Splunk and Exabeam with contextual peer baselines, dynamic thresholds, and multi-signal confirmation. The updated baseline logic reduced monthly alerts from roughly 140 to about 26, cutting false positives while improving the rate of meaningful true-positive findings.
02. Python Investigation Pipeline Suite
Developed modular Python CLI scripts that ingest case identifiers, query SIEM APIs in parallel, normalize timestamps, enrich IP/user metadata, and generate standardized markdown/PDF case files automatically.
What I Shipped
Collaborative SPL Investigation Agent
Built an environment-aware AI agent that works with the analyst to turn an investigative question into Splunk SPL, explain its choices, and refine the query using the organization’s real indexes, sourcetypes, and field conventions.
Dashboards & Automated Stakeholder Reporting
Shipped Splunk dashboards for leadership, HR, and Legal reporting, with automated updates that kept the relevant stakeholders informed without requiring analysts to rebuild the same briefing by hand.