tonk
tonk :)
threat hunter · detection engineer · cyber risk
stay curious, fail forward.
whoami

My career hasn't followed a straight line, and that's turned out to be an advantage.

I spent nearly a decade as a professional musician before moving into cyber. The two are closer than they sound: both come down to hearing a faint pattern under a lot of noise, staying composed when it matters, and adjusting in real time.

Today I work on two fronts: cyber risk engineering (vulnerability management, application security testing, GRC) and hands-on defensive cyber operations. Most of my time goes into network security monitoring: building detection workflows, working through raw PCAP, and writing the tooling to catch what default alerting misses.

I approach it the same way I approached music: curiosity, discipline, and a willingness to rethink what I thought I knew. Off the keyboard, I'm usually out on jogs with my dogs or dialing in espresso.

specialties: threat hunting · network security monitoring · detection engineering · purple teaming · vulnerability management · risk management

what i build & break

hunting & telemetry

  • Network behavioral hunting
  • Raw packet dissection and traffic reconstruction
  • NSM pipeline design: Zeek, Suricata, Arkime, Malcolm
  • Kibana / Elastic query development

engineering & automation

  • Python tooling and Streamlit dashboards
  • Detection-as-code pipelines and GitHub Actions
  • Linux systems administration
  • Labs on Docker, Proxmox, pfSense, OPNsense

risk & appsec

  • Vulnerability lifecycle management
  • Application security testing
  • Attack surface reduction
  • MITRE ATT&CK mapping and coverage analysis
what i'm into
▸threat hunting ▸paddleboarding ▸network forensics ▸daggerheart / d&d ▸being incredibly average at intramural sports ▸detection engineering ▸home lab tinkering ▸oscar's coffee ▸jogs with my dogs ▸cryptographic puzzles ▸dark synthwave ▸making things from scratch
learnin' and buildin'
TONK · Threat Observation & Network Kill-chain
A family of MITRE ATT&CK-mapped threat hunting tools I build and use on real hunts. Every kit keys on the same technique IDs, so an intel report, a playbook, a hunt query and a purple-team test all line up without translation.
hunt.6b74.dev Network and host hunt workbenches with paste-ready Kibana, Arkime, Suricata and host queries, actor playbooks, and evidence-driven attribution that ranks likely actors from what you've found. intel.6b74.dev Automated OSINT pipeline on GitHub Actions. Pulls threat reporting every 6 hours, matches it to TONK actors, techniques, tools and CVEs, and queues up the coverage gaps worth building next. purple.6b74.dev Purple-team companion. Adversary-emulation triggers paired with the telemetry each one should produce, plus per-technique validation tracking, so you can prove a detection actually fires. detect.6b74.dev Training simulator. Spot malicious activity in flow tables and log streams across ATT&CK-mapped scenarios: beaconing, DNS tunneling, lateral movement, Kerberoasting, exfil and more.
home network rebuild
Full home network overhaul with VLAN segmentation (Family / IoT / Guest / Gaming / Security). Protectli VP2420 running OPNsense, TP-Link managed switch, EAP670 Wi-Fi 6 AP, Beelink mini PC running Security Onion + Pi-hole. Zeek and Suricata feeding Elasticsearch + Kibana for full home network visibility.
→ running in the rack
connect
github linkedin email me!