Skip to content
Issue #01 · Case Files

Break it.Trace it.Defend it.

I’m Guntur Wahyu Ramadhan, an Information Security Engineer. I test how systems break, investigate what happened, and turn the findings into detection and automation — from penetration testing to SIEM and SOAR engineering.

Explore My ProjectsAbout Me
  • Information Security Engineer
  • Security Analyst
  • Penetration Tester

Chapter 01 · Origin

The person behind the files

Now

Information Security Engineer

GdpLabs · Jul 2026 – Present

Detection engineering, SIEM tuning, threat intelligence and hunting.

Previously

Penetration Tester · Widya Security

Web, mobile (Android & iOS) and server penetration testing.

Full work history →

Training

  • Yogyakarta State University

    Information Technology — Bachelor’s Degree

    2022 – 2026

  • Universiti Tun Hussein Onn Malaysia

    Online Inbound Mobility: Project Management (Grade: A)

    Jul – Sep 2023

Proof of work

  • 1st Place — Incident Response, Rise The Ranger 2 CTF 2026Satsiber TNI
  • 1st Place — National Cyber Exercise #3BSSN · Apr 2024
  • Top 5 Bug BountyKemendikdasmen · Jun 2026

7 certifications

  • CEH
  • CRTA
  • CSCU
  • API-RTA
  • MCBTA
  • CCDA
  • CNSP
Verify credentials →

Chapter 02 · The strip

Four panels, one discipline

Where I spend my time. Each panel links to the real work behind it. The artwork uses fictional lab data.

Report · VR-001

Unsanitised input reaches a database query

CVSS 9.8fictional
review/views.pyFictional snippet
12 def get_user(request):
13   uid = request.GET["id"]
14   q = "SELECT * … id=" + uid
15   return db.execute(q)
input → query, no validation
Panel 01 · Vulnerability Research

“Every vulnerability leaves a trail.”

Top 5 Bug Bounty · Kemendikdasmen

Repeater · lab-target.testAuthorized lab
GET /api/orders/1042 HTTP/1.1
Host: lab-target.test
Authorization: Bearer redacted
HTTP/1.1 200 OK
{ "owner": "user-77", "total": … }
Attack path · illustrative
ENTRYFOOTHOLDPIVOTGOALT1190
owner ≠ requester?
Panel 02 · Offensive Security

“Understand the attack. Strengthen the defense.”

Penetration Tester · Widya Security

Evidence timeline · fictional host

09:12 logon
09:14 shell
09:20 service
09:31 egress
C:\Users\lab\AppDataArtifacts
  • ▸ Roaming\
  • ▸ Temp\upd4te.ps1
  • ▸ Local\History
4d 5a 90 00 03 00
00 00 04 00 00 00
ff ff 00 00 b8 00
70 6f 77 65 72
magnify the artifact
Panel 03 · Digital Forensics

“Reconstruct what happened.”

38 CyberDefenders labs completed

detection-sketch.ymlIllustrative
title: JNDI lookup in web logs
detection:
  selection:
    uri|contains: '${jndi:'
  condition: selection
level: high

Telemetry · demo

  1. Write
  2. Test
  3. Deploy
  4. Tune
Panel 04 · Security Engineering

“Turn findings into better defenses.”

Detection-as-code · SIEM · SOAR

Chapter 03 · Selected projects

Case files

Operations and investigations from my own labs and pipelines. Nothing here is client work.

All projects →
Case 001
Architecture diagram: endpoints to Wazuh server, n8n automation flow, DFIR-IRIS and alerting platforms.
Architecture

SIEM · Incident Response

Multi-Endpoint Security Monitoring with n8n Alert Automation and DFIR-IRIS

Wazuh as the central SIEM for Windows, macOS, Linux and Google Cloud endpoints, with n8n alert automation feeding DFIR-IRIS incident management.

  • Wazuh
  • n8n
  • DFIR-IRIS
  • SIEM
  • Automation
See on Projects
Case 002
Flowchart of the pipeline from target through subdomain enumeration, port scan, vulnerability scanner to PDF report.
Pipeline

Offensive Automation

Automated Web Application Security Assessment: OSINT to Vulnerability Reporting

An end-to-end pipeline that chains subdomain enumeration, scanning and fuzzing into a single vulnerability report.

  • OSINT
  • Nuclei
  • Subdomain Enumeration
  • Fuzzing
See on Projects
Case 003
Search · illustrativeDemo data
index=wineventlog EventCode=4625
| stats count by Account_Name
lab-user-013
lab-user-021
lab-admin27
Write-up available

Detection · Cloud

SIEM Monitoring Windows Logs with Splunk on GCP

Splunk on a Google Cloud VM, ingesting Windows event logs from a local laptop via Universal Forwarder for analysis, alerts and dashboards.

  • Splunk
  • Windows
  • GCP
  • SIEM
Open case file

Chapter 04 · Equipment

The arsenal

Tools I actually use, grouped by the job they do. No skill bars — a tool in the case is not a claim of mastery.

Offensive Security

A-01

Web, API and mobile testing

  • Burp Suite
  • Metasploit
  • Nuclei
  • Frida
  • ADB
  • Kali Linux

Network Analysis

A-02

Discovery and packet-level investigation

  • Nmap
  • Wireshark
  • CyberChef· CyberDefenders labs

Forensics & Reverse Engineering

A-03

Used across CyberDefenders labs

  • Volatility
  • FTK Imager
  • Ghidra
  • ALEAPP · JADX

Security Engineering

A-04

Detection, SIEM and SOAR

  • Wazuh
  • Splunk
  • Graylog
  • Tracecat
  • Shuffle SOAR
  • n8n
  • DFIR-IRIS

Programming & Automation

A-05

Glue code and tooling

  • Python
  • Bash
  • TypeScript
  • JavaScript
  • PHP

Infrastructure & Cloud

A-06

Where the labs live

  • Docker
  • Git
  • GitHub
  • Google Cloud
  • Debian · Ubuntu

Frameworks

OWASP ASVS / WSTG · NIST CSF · ISO 27001

Chapter 05 · Field notes

Research transmission

Write-ups and notes, pulled live from my Medium feed.

All articles →

Final panel · End of issue #01

The next chapter
starts here.

Have a security project, research idea, or technical challenge worth exploring? Say hello.

To be continued…