Greg Olmstead

A Kubernetes-based threat processing and alerting platform. It consumes data from disparate feeds, e.g., Certstream, Pastebin, etc., processes it to enrich it with public data, such as DNS, WHOIS, and JA3, and allows organizations to query or set up alerts when data matches.

Various use cases include detecting malicious infrastructure via fraudulent domain names and TLS certificates. It processes 10 million certificates, 21 million domains, and 140 million DNS digs daily on 3-server commodity hardware. Also, it is a fully pluggable framework for ingestion, enrichment, alerting, and output, based on Kafka and backed by Elasticsearch.

I designed and implemented the full implementation along with my business partner.

A next-generation Cuckoo-based malware analysis platform. It leverages Cuckoo under the hood and adds significant functionality like YARA/Suri hunting, advanced search, and network/host indicator matching with added product integration, i.e., Moloch and MISP, and one-button deployment automation to democratize malware analysis and facilitate rapid deployment of sandboxes in incident scenarios. Its commodity hardware processes 7,500 samples daily with 12-15TB of memory dumps per day.

I designed and implemented the entire solution alongside my business partner and presented it at multiple Defensive and Technical Security conferences.

A web application developed in partnership with Jim Leach to calculate and display information about whether purchasing a particular property as a rental property would be a good investment, as well as details about the investment returns.