From Cloud to Detection: How I Built a Complete Cybersecurity Portfolio (10 Projects in 10 Levels)

From Cloud to Detection: How I Built a Complete Cybersecurity Portfolio

By - Sidharth Sanwariya | May 2026

Why I Built This Portfolio

After months of learning, I decided to document my entire cybersecurity journey. This article covers 10 projects across 10 skill levels — from AWS cloud security to incident investigation.

All projects were done in my own home lab using free tools. Every screenshot, script, and report is available on my GitHub.

Level 41–45: AWS Cloud Security

What I Learned

• IAM (users, groups, policies, MFA)
• S3 buckets (public vs private, Block Public Access)
• CloudTrail (audit logging)
• GuardDuty (threat detection)
• VPC Flow Logs (network traffic monitoring)

Key Project Created an S3 bucket, made it public (simulated misconfiguration), then fixed it using Block Public Access.

GitHub [Cloud Security Lab] (https://github.com/Sidharth-Sanwariya?tab=repositories)

Level 46–47: Sigma Rules & Detection Engineering

What I Learned

• Sigma rule structure (title, id, logsource, detection, condition)
• Converting Sigma to Splunk and Elastic using uncoder.io
• MITRE ATT&CK mapping

Key Project Wrote Sigma rules for:

• Multiple failed logons (4625)
• Admin login detection (4672)
• Service stopped (7036)
• Failed sudo attempts (Linux)

GitHub Sigma Detection Rules

— -

Level 48: SIEM with Splunk

What I Learned

• Splunk Enterprise installation
• Universal Forwarder configuration
• SPL (Search Processing Language) queries
• Windows Event Log forwarding

Key Project Forwarded Windows Security logs to Splunk and searched for Event ID 4625 using:

spl index=main EventCode=4625

Level 49: YARA Malware Detection

What I Learned

• YARA rule structure (meta, strings, condition)
• Writing custom rules for suspicious patterns
• Testing with EICAR test file
• VirusTotal integration

Key Project Created YARA rules to detect:

• PowerShell download patterns
• Suspicious executable strings
• Cryptocurrency wallet stealers

GitHub YARA Detection Rules

Level 50: Incident Investigation

What I Learned

• Windows Event Log analysis
• Failed login detection (Event ID 4625)
• Attacker IP and username identification
• Professional incident report writing

Key Project Simulated a brute force attack using PowerShell, generated 51 failed login events, and wrote a complete incident report.

GitHub Incident Investigation Lab

Tools Used Across All Projects

| Category | Tools | | — — — — — | — — — -| | Cloud | AWS (IAM, S3, CloudTrail, GuardDuty, VPC) | | Detection | Sigma, YARA, uncoder.io | | SIEM | Splunk Enterprise, Universal Forwarder | | Analysis | Event Viewer, PowerShell, Wireshark | | Documentation | GitHub, Medium, Markdown |

Key Takeaways

1. Start with a lab — You can’t learn security without hands-on practice
2. Document everything — Screenshots, scripts, and reports help you learn and prove your skills
3. Think like an attacker — Simulate real attacks to understand detection
4. Learn detection, not just exploitation — Companies need defenders more than attackers
5. Build in public — GitHub and Medium articles get you noticed by recruiters

What’s Next?

I’m continuing my journey into:

• Bug Bounty Hunting
• Azure Cloud Security
• Advanced Malware Analysis

Follow me on LinkedIn and GitHub for more.

Resources

• Sigma Rules Repository
• YARA Rules Repository
• Incident Investigation Lab

Thanks for reading! Feel free to connect or ask questions.