T Yashwanth Raj

Designed a rule set to bucket simulated security events into low/medium/high priority using log evidence alone, aimed at cutting analyst time spent on noise and surfacing the handful of events that actually mattered.

Broke down suspicious emails at the header, domain, and payload level — sender spoofing, lookalike domains, malicious attachments — and turned the findings into a repeatable triage checklist.

Worked through Windows Security event data to isolate failed logons, lockout patterns, and privileged-account activity, mapping how that evidence supports a real incident narrative.

Studied TCP, UDP, DNS, DHCP, and ARP behavior specifically to build a 'what does normal look like' baseline, then used that baseline to spot deviations worth flagging.

Cross-referenced sample IPs, domains, and file hashes against log data to practice deciding, with limited context, whether an indicator needs escalation or just monitoring.