$ whoami
Omar Lyahyai
Systems, network & security engineer · Master 2 Cyber-Defense
I run production infrastructure for a living and build security tooling on the side. My Master’s final-year project is a self-hosted SOC/SOAR; the case studies below show how it was built, what broke, and how each problem was traced to its root cause.
Case studies
Real problems from building a self-hosted SOC/SOAR, with the root cause and what changed.
- 01
A self-hosted SOC/SOAR on a three-node homelab
The architecture of my Master’s final-year project: what it collects, how it reacts, and the rules it is built on — no public exposure, every change versioned, every claim tested.
- 02
When the SIEM goes blind without a single error
Three silent failures in two days, none raised by the SIEM itself. Tracing them to one root cause, then building a watchdog that would have caught all three.
- 03
Detection as code: versioning a live SIEM ruleset
Putting the Wazuh ruleset under Git without a sync step that can drift, and a non-regression suite built from real log lines — proven by a negative control that brings an old bug back.
- 04
Automatic IP blocking without giving the SIEM the keys to the firewall
A critical IDS alert bans the attacker at the firewall within seconds, for ten minutes. The interesting part is what the SIEM is not allowed to do, and two bugs that only a real end-to-end test revealed.
- 05
Letting AI agents operate a homelab, under control
LLM agents that can query the SIEM and manage containers from my phone — confined by three independent layers of permissions. And the day one agent tried to work around a missing tool, which showed what the SIEM could not yet see.
Other work
- PurpleOps2026
Native Android app that runs a Kali chroot and shows a live Wazuh dashboard over Tailscale. Signed releases built by GitHub Actions. - Homelabongoing
pfSense perimeter (Suricata, CrowdSec), VLAN segmentation, isolated purple-team lab, Tailscale-only remote access. - JBR.ma2025 – 2026
E-commerce SaaS for Moroccan artisans and merchants: Next.js, Strapi, PostgreSQL, CI/CD and Cloudflare Tunnels.