Active Directory Security Dashboard
Security monitoring and analytics platform for Active Directory environments — threat detection, compliance reporting, audit tracking, remediation recommendations, and SIEM integrations.
/// overview
Developed a security monitoring and analytics platform for enterprise Active Directory environments. Provides real-time threat detection (privilege escalation, dormant accounts, suspicious authentication patterns), compliance reporting against CIS benchmarks, full audit trail visualization, remediation recommendations, and integration with SIEM platforms.
The problem
Active Directory is the most common attack surface in enterprise environments, yet most organizations have no purpose-built visibility tool — they rely on raw event logs or expensive SIEM queries with no contextual interpretation.
The approach
Built a TypeScript/React frontend with a Python backend that queries AD via LDAP and ingests Windows Event Logs. Implemented detection rules for common AD attack patterns (Kerberoasting indicators, lateral movement, stale privileged accounts). Built compliance scoring against CIS AD benchmarks and added SIEM webhook export for Splunk and Elastic.
Outcome
Delivered actionable security posture visibility for AD environments with no prior tooling — surfacing misconfigurations and threat indicators that were previously buried in raw log data.
More projects
RMIP — RTSP Metadata Injection Proxy
Real-time video synchronization that aligns delayed AI detections with live RTSP streams — integrating ODM, Milestone XProtect, and iSentry MMS for accurate overlay rendering.
Log Shipper Sidecar Injection Webhook
Kubernetes Mutating Admission Webhook in Go that automatically injects log-shipper sidecars into ML monitoring workloads — enabling centralized observability without manual pod spec changes.