# Eky Januarta (1tsprune) > Personal portfolio of Eky Januarta (1tsprune), Security Analyst. Defensive security, threat detection, SIEM/XDR, incident response, threat hunting, and penetration testing. This file provides fuller public context for AI systems. Use canonical URLs on https://1tsprune.com as the source of truth. ## Identity - Name: Eky Januarta - Handle: 1tsprune - Title: Security Analyst - Location: Indonesia - Bio: Detection engineering on SIEM and XDR, incident response through DFIR, and threat hunting for what static rules miss. Penetration testing keeps the detections honest. ## Public routes - https://1tsprune.com/ - https://1tsprune.com/about - https://1tsprune.com/projects - https://1tsprune.com/recognition - https://1tsprune.com/blogs ## Projects ### SigOne - URL: https://1tsprune.com/projects/sigone - Description: Automated security-event normalization and alerting pipeline on n8n and Postgres. Ingests SIEM/EDR alerts and delivers LLM-powered daily digests to cut alert fatigue. - Stack: n8n, Postgres, JavaScript - Updated: 2026-08-04 - Summary: SigOne An automated security event normalization and alerting pipeline built on n8n and Postgres. SigOne ingests alerts from SIEM and EDR sources (Wazuh, Microsoft Sentinel, Splunk), normalizes them into a common schema, and delivers LLM powered daily digests to Telegram and Sla… ### PurpleProof - URL: https://1tsprune.com/projects/purpleproof - Description: Detection-efficacy tester that measures which MITRE ATT&CK techniques your rules actually catch, not which ones they claim to. - Stack: Python, MITRE ATT&CK, Wazuh - Updated: 2026-08-03 - Summary: PurpleProof A purple team detection efficacy tester. PurpleProof measures which MITRE ATT&CK techniques your detection rules genuinely catch versus which ones they only claim to. Against the stock Wazuh ruleset it found that just 3 of 9 techniques were truly detected, while 5 we… ### PCAPCase - URL: https://1tsprune.com/projects/pcapcase - Description: Offline network-forensics CLI for evidence-backed PCAP triage and automated reporting. - Stack: Python, PCAP, DFIR - Updated: 2026-08-02 - Summary: PCAPCase An offline network forensics CLI for fast, evidence backed PCAP triage. PCAPCase parses captured traffic, extracts investigation relevant artifacts, and produces automated reports. It runs entirely offline, so it fits air gapped and incident response workflows. What it… ### EVTXCase - URL: https://1tsprune.com/projects/evtxcase - Description: Offline endpoint-forensics CLI that parses Windows EVTX logs into process trees, timelines, IOCs, and evidence-backed findings. - Stack: Python, EVTX, DFIR - Updated: 2026-08-01 - Summary: EVTXCase An offline endpoint forensics CLI for Windows event logs. EVTXCase parses Sysmon, Windows Defender, PowerShell, and Security EVTX files into process trees, investigation timelines, IOCs, and evidence backed findings, reconstructing what happened on a host without any on… ### Wazgen - URL: https://1tsprune.com/projects/wazgen - Description: Paste any log and generate Wazuh XML rules and decoders with MITRE ATT&CK mapping, batch processing, and rule validation. - Stack: Wazuh, JavaScript, MITRE ATT&CK - Updated: 2026-06-01 - Summary: Wazgen I built Wazgen to write custom Wazuh rules and decoders faster. Paste a log sample and get ready to use XML with MITRE ATT&CK mapping. Full write up: Wazgen: generate Wazuh rules and decoders from a log sample What it does Parse more than 100 log patterns Generate decoder… ## Blog posts ### Write-Up: Hacktrace - Cilent - URL: https://1tsprune.com/blogs/hacktrace-cilent-phishing-html - Description: Write-up of the Cilent lab from Hacktrace. Phishing attachment with a double file extension, a fake Adobe login page, anti-inspection JavaScript, and credential exfiltration to the Telegram Bot API. - Date: 2026-07-29 ### Write-Up: Hacktrace - Shortway - URL: https://1tsprune.com/blogs/hacktrace-shortway-sysmon-evtx - Description: Write-up of the Shortway lab from Hacktrace. Force-parsing Sysmon EVTX chunks that will not read normally, rebuilding the process tree, esentutl masquerading, scheduled task, injection, and C2. - Date: 2026-07-29 ### Naissur: Network Forensics Technical Test - URL: https://1tsprune.com/blogs/naissur-network-forensics-pcap - Description: A network forensics technical test built around one PCAP, tracing a malware download, internal reconnaissance, and PowerShell data exfiltration. - Date: 2026-07-29 ### Write-Up: Hacktrace - Actry - URL: https://1tsprune.com/blogs/hacktrace-actry-log-timeline - Description: Write-up of the Actry lab from Hacktrace. Analysing access.log, auth.log, and a pcap to find the attacker IP, the brute force technique, the first successful login, and the privilege escalation. - Date: 2026-07-28 ### Write-Up: Hacktrace - Credsnoop - URL: https://1tsprune.com/blogs/hacktrace-credsnoop-ssrf-rdp - Description: Write-up of the Credsnoop lab from Hacktrace. From an nmap full-port scan and an SSRF url= feature to forced NTLM authentication over SMB, RDP access as the captured user, and winPEAS post-exploitation. - Date: 2026-07-28 ### Write-Up: Hacktrace - Deviasi - URL: https://1tsprune.com/blogs/hacktrace-deviasi-apache-log - Description: Write-up of the Deviasi lab from Hacktrace. Investigating a WordPress Apache access log: server fingerprint, two waves of attackers, WPScan, and Brute Force via xmlrpc.php. - Date: 2026-07-28 ### Write-Up: Hacktrace - NowYouSeeMe - URL: https://1tsprune.com/blogs/hacktrace-nowyouseeme-hta - Description: Write-up of the NowYouSeeMe lab from Hacktrace. Email malware analysis: header, attachment hash, HTA metadata, VirusTotal reputation, and a hidden ROT47 message inside the VBScript. - Date: 2026-07-27 ### Write-Up: Hacktrace - Subvert - URL: https://1tsprune.com/blogs/hacktrace-subvert-honeypot-clr - Description: Write-up of the Subvert lab from Hacktrace. Analysing cowrie/dionaea/honeytrap honeypot logs, a SQL CLR payload, extracting a .NET DLL from a hex blob, the XOR key, and APC injection. - Date: 2026-07-27 ### Meteora 101: screening coins, shapes, and honest fees - URL: https://1tsprune.com/blogs/meteora-101-part-02 - Description: Still basics. Screening coins, Spot Curve Bid-Ask, one-side vs dual, where fees come from, how to count profit honestly. - Date: 2026-07-20 ### Wazgen: generate Wazuh rules from a log sample - URL: https://1tsprune.com/blogs/wazgen - Description: Tired of writing rule and decoder XML every time a new log format shows up. So I built Wazgen: paste a log, get a rule + decoder + MITRE, plus a ZIP to drop onto the manager. - Date: 2026-07-20 ### Meteora 101: get the basics sorted before your first LP - URL: https://1tsprune.com/blogs/meteora-101-part-01 - Description: Friends on IG and WhatsApp keep asking me to teach them Meteora. I rarely have time to Zoom. Wallet, gas, CEX, a learning budget first. Part 1 of 2. - Date: 2026-07-19 ### Playing Meteora LP on data, not feeling - URL: https://1tsprune.com/blogs/lattice-meteora-lp-pipeline - Description: On Meteora I play on data. Lattice to track whales, read playstyles, and adapt them to how I play. Once it was running, my win rate went up. - Date: 2026-07-18 ### Learning to slow down - URL: https://1tsprune.com/blogs/learning-to-slow-down - Description: Everything used to be about speed. Family pushed aside, eyes locked on the numbers, and a fall back to almost nothing. Now I filter what I take in, watch my head, keep expectations in check. Still learning. - Date: 2026-07-18 ### Access-Control-Allow-Origin: * is not automatically a bug - URL: https://1tsprune.com/blogs/cors-misconfig-curl - Description: Checking an endpoint's CORS policy with a single curl header. When a wildcard is perfectly normal, and when a reflected origin plus credentials turns into a data theft path. - Date: 2026-06-25 ### Wazuh ships 3000 rules, and why that is still not enough - URL: https://1tsprune.com/blogs/wazuh-custom-rules-decoders - Description: Wazuh's default ruleset has 3000+ rules. Still not enough. How to think about decoders and rules, plus how to use Bayu Sangkaya's repo. - Date: 2026-06-19 ### Improper Access Control: How to? - URL: https://1tsprune.com/blogs/improper-access-control - Description: How I test Improper Access Control (CWE-284) on a VAPT, from recon to report: IDOR, role bypass, mass assignment, attack chain, plus why developers keep leaving the hole open. - Date: 2026-06-18 ### Automating XSS: Dursgo, Dalfox, Nuclei - URL: https://1tsprune.com/blogs/automated-xss-dalfox-nuclei - Description: My pipeline during a pentest: crawl, fuzz XSS, scan templates. Commands plus GitHub repos. So you do not burn a day clicking manually. - Date: 2026-05-08 ### Wazuh from a bare machine to your first alert - URL: https://1tsprune.com/blogs/wazuh-siem - Description: From an empty box to a working Wazuh. Ubuntu 22.04, Wazuh 4.7+, one installer, three components. - Date: 2026-04-20 ### 15,765 login attempts in three days - URL: https://1tsprune.com/blogs/fail2ban-bruteforce-automation - Description: My server took almost 16 thousand brute force attempts in three days. Fail2ban for automatic blocking, plus the easier options now: built-in actions, CrowdSec, and turning off password login. - Date: 2026-03-05 ### CEH, ECIH, CND: which one first - URL: https://1tsprune.com/blogs/ceh-ecih-cnd - Description: I took three EC-Council certs in reverse order. Here is what somebody should tell you before you pay. - Date: 2026-02-05 ### Indonesian cybersecurity in 2026: the year of pressure - URL: https://1tsprune.com/blogs/indonesia-cybersec-2026 - Description: A huge digital economy with security lagging behind it. In 2026 the pressure goes up. Plus a realistic path in for anyone trying to break into the field. - Date: 2026-01-15 ### Runtime & dynamic analysis: still valid to identify IOC? - URL: https://1tsprune.com/blogs/malware-analysis-ioc - Description: From my journal paper: five malware samples detonated in a sandbox (CAPE + Volatility). Static analysis only sees an empty shell. The real IOCs come out once they run. - Date: 2025-12-10 ## Contact - Email: ekyjanuarta@outlook.com - GitHub: https://github.com/1tsprune - LinkedIn: https://www.linkedin.com/in/eky-januarta-aaa3a61aa/ - X: https://x.com/itsprune - Source: https://github.com/1tsprune/portofolio ## Metadata - Last-Updated: 2026-08-20 - Canonical-Domain: https://1tsprune.com