IT Ops Incident Workflow Simulation
🔎 Overview
This project demonstrates a full incident workflow simulation designed to mirror real SOC operations. Using Splunk, Jira, and PowerShell, I built an end-to-end pipeline to detect malicious activity, create incidents, enforce SLAs, and export evidence — just like a Security Engineer or SOC Analyst would in an enterprise environment.
⚙️ Key Features
Detection (Splunk): Ingested Sysmon logs and triggered alerts on suspicious PowerShell activity.
Triage (Jira): Auto/manual ticket creation with SLA timers and priority escalation.
SLA Enforcement: Escalation rules activate when SLA targets are breached.
Evidence (PowerShell): Automated Active Directory change log export, attached to Jira tickets.
Workflow Diagram: Visual representation of detection → ticketing → SLA → escalation → evidence.
🎯 Why It Matters
In real-world SOCs, analysts don’t just spot alerts — they manage the entire incident lifecycle:
Configuring SIEM detections to spot malicious behavior.
Tracking and prioritizing incidents with SLAs.
Handling escalations when issues aren’t resolved in time.
Collecting evidence for compliance and audit.
This project shows I can design, document, and execute these workflows using free tools — proving hands-on skills that map directly to SOC Analyst and Security Engineer roles.
🔗 Project Resources
🖼️ Workflow Diagram included in README
📜 Setup Instructions for reproducibility
⚙️ Scripts & sample artifacts included
