Aug 2021 – presentRemote
Information Security Engineer (SIEM)
Graylog, Inc.
Selecting, creating and tuning more than 300 Sigma rules against current threats, integrated into Graylog.
> whoami
Stefan Waldvogel
Cybersecurity professional in SIEM and detection engineering, with over 30 years in IT.
Personal-finance enthusiast with the Financial Planning & Wealth Management Professional (FPWMP®) credential. I love exploring and building things with AI tools.
profile.status
Stefan Waldvogelstefan@waldvogel:~$
- role
- Information Security Engineer (SIEM)
- focus
- Detection engineering · Sigma rules
- experience
- 30+ years in IT
- credentials
- FPWMP® · eCPPT · Server+ · +2
- location
- Texas, USA
- status
- ● building with AI
30+years in IT
300+Sigma detection rules selected, written and tuned
50countries visited
2×around the world
01 // career
Career
- Aug 2019 – Aug 2021Cedar Park, Texas
Cybersecurity Mentor & Educator
Created a cybersecurity career website, cyberhuntingguide.weebly.com, with more than 200 pages and 80,000 views. Now as a compact tool: /cyber-hunting-guide.
Show full career (3 more)
- Sep 2017 – Jan 2019Bavaria, Germany
Senior IT-Engineer (Information Security Manager)
Airbus Defence and SpaceImplemented and taught an information security management system (SAVe 5) to improve the security posture of the German Air Force, and advised developers on compliance.
- Sep 2015 – Mar 2016
Student Assistant
Rheinische Fachhochschule KölnLab experiments on software-defined radio (HackRF One) and teaching electronic components.
- Sep 2006 – Sep 2011Neuburg an der Donau
Database and Systems Administrator
Bundeswehr (German Federal Armed Forces)Tier 1–2 IT support; administered and monitored Oracle databases.
02 // skills
Skills and evidence
What I work on, with the evidence: tools on this site and the role or credential behind each area.
SIEM and log pipelines
Getting logs into a SIEM in usable shape: parsers for GROK, JSON, key=value, CSV and XML, timestamp patterns and Graylog pipeline rules.
- on this site
- Log Parser Builder · Graylog Toolkit
- background
- Graylog, Inc.
Detection engineering
Selecting, writing and tuning Sigma rules (more than 300 at Graylog), converting and unit-testing them, documenting detections as ADS and narrowing noisy alerts.
- on this site
- Sigma Workbench · Detection Desk
- background
- Graylog, Inc.
Windows and Sysmon telemetry
Which Windows Security, Sysmon, PowerShell and Defender events matter, how attackers show up in them and which audit settings produce them.
- on this site
- Event Reference
- background
- Graylog, Inc.
Threat-informed coverage (MITRE ATT&CK)
Mapping log sources and rules to ATT&CK techniques, finding the gaps and planning detection tests.
- on this site
- Coverage Planner · Sigma Workbench (coverage)
Investigation and DFIR helpers
Extracting and defanging IOCs, decoding obfuscated command lines without running them, and merging logs into one UTC timeline.
- on this site
- Analyst Kit
Offensive background
Penetration testing, certified as eCPPT: the attacker’s side of detection.
- background
- eCPPT
Information security management
Implemented and taught an information security management system (SAVe 5) for the German Air Force and advised developers on compliance.
- background
- Airbus Defence and Space
Systems and database administration
Tier 1–2 IT support and Oracle database administration and monitoring, with credentials in IT administration and servers.
- background
- Bundeswehr · CompTIA Server+ · IT Administrator (DEKRA)
Security engineering for the web
This site itself: a strict Content Security Policy for each page, no outside requests, checked imports and inert exports.
- on this site
- SECURITY.md
The tools were built with AI assistance and designed, reviewed and tested by me.
03 // detection toolkit
Detection toolkit
Browser tools for SIEM, detection and analysis work. They run entirely on your device; nothing is uploaded.
> siem & detection
tool · siem/grok-builder
Log Parser Builder
GROK · JSON · key=value · CSV · XML: detects your log format and builds the parser — several patterns when lines differ, vendor format starting points — tests it live and exports it to Graylog / Logstash / Elastic.
open →tool · detection/sigma-workbench
Sigma Workbench
Write and validate Sigma rules, convert them to Graylog, Lucene, ES|QL, KQL or SPL, unit-test them and map your coverage to MITRE ATT&CK.
open →reference · windows/event-reference
Event Reference
About 70 Windows, Sysmon, PowerShell and Defender events in plain words: key fields, attacker use, noise, audit settings and a Sigma starting point — plus a Sysmon config helper.
open →tool · graylog/graylog-toolkit
Graylog Toolkit
Timestamp patterns for Java, Joda, Graylog, Logstash and Elasticsearch, a pipeline rule linter and formatter, and a field mapping reference.
open →tool · detection/detection-desk
Detection Desk
Document detections as ADS, keep a threat hunting notebook and tune noisy alerts with narrow exclusions and breadth warnings.
open →tool · analysis/analyst-kit
Analyst Kit
Extract IOCs with defang and refang, peel obfuscation layers off command lines without running them, and merge logs into one UTC timeline.
open →tool · att&ck/coverage-planner
Coverage Planner
Map the telemetry you collect to ATT&CK v20 detection analytics, find the gaps, export a Navigator layer and plan detection tests.
open →> security careers
04 // credentials
Credentials
offensive security
eCPPT
eLearnSecurity Certified Professional Penetration Tester
infrastructure
Server+
CompTIA Server+
IT administration
IT Administrator
DEKRA Akademie GmbH
education
State Certified Engineer
Werner-von-Siemens-Schule Köln
finance
FPWMP®
Financial Planning & Wealth Management Professional
05 // side projects
Side projects
Games, simulations and everyday tools I built for the browser. The ones hosted here run entirely on your device.
> history & simulation
game/pre-carre
Pré Carré
A siege chronicle in the spirit of Vauban: fortify a town through seventeen centuries of war, then dig up what survived.
open →builder · 2D/3D/castellan
Castellan
A castle builder: draw walls, towers and halls on a plan, see them in 3D, run their history on a timeline and take guided tours of real castles.
open →editor/workshop
Castellan Workshop
The editor for Castellan's interiors and library parts: rooms, furnishings, stairs and reusable building parts.
open →simulation/armour
Armour Proving Ground
A sandbox for WWII battleship armour: design a cross-section, then fire historical guns and shells at it and follow each round.
open →> learning & everyday
language · trainer/korean-metro
Korean Metro
A Korean vocabulary and dialogue trainer in the style of the Seoul subway map: lessons are lines, exercises are stations, with your device's Korean voice.
open →game · career/job-hunt
Job Hunt
A game about breaking into tech: you and about thirty rivals compete for scarce security jobs over 36 months. Win with experience, a network — or as a rare unicorn.
play →ledger · demo/lesson-ledger
Lesson Ledger
A studio ledger for music teachers: students, calendar, income, self-employment tax and 1040-ES estimates. A demo; your data stays in your browser.
open →finance · plannerexternal ↗
PurpleTeam Financial Planner
A free retirement planner in the browser: Monte Carlo simulation, taxes, Social Security and Medicare.
purpleteamfinance.com ↗Built with AI tools. I made these with Claude, because I enjoy experimenting with what AI tools can do.
~/shell · type “help”
Type a command and press Enter. Tab completes a command or project name; the up and down keys browse the history.
$ tail -n 5 updates.log
- Small fixes: Job Hunt plurals, CEF escapes unescaped in generated Graylog rules, shorter rule titles, security.txt contact, a note on dates without a yearKleine Korrekturen: Plural im Job Hunt, CEF-Escapes in erzeugten Graylog-Regeln aufgelöst, kürzere Regeltitel, security.txt-Kontakt, ein Hinweis zu Daten ohne Jahr
- Log Parser Builder: simulate the Graylog rule in the page, timestamp step, unseen key=value keys as vendor_, pattern performance, field profile, sample anonymiserLog Parser Builder: Graylog-Regel im Browser simulieren, Zeitstempel-Schritt, unbekannte key=value-Schlüssel als vendor_, Pattern-Performance, Feldprofil, Beispiel-Anonymisierer
- Graylog names: fields outside the official schema get a vendor_ prefix in the Log Parser Builder, Toolkit, Sigma Workbench and Detection Desk; CEF duser maps to destination_user_nameGraylog-Namen: Felder außerhalb des offiziellen Schemas bekommen im Log Parser Builder, Toolkit, Sigma Workbench und Detection Desk das Präfix vendor_; CEF-duser wird zu destination_user_name
- Graylog names follow the official Graylog Illuminate field schema; generated pipeline rules use one clean layout and remove_single_field / remove_multiple_fieldsGraylog-Namen folgen dem offiziellen Graylog-Illuminate-Feldschema; erzeugte Pipeline-Regeln haben ein einheitliches Layout und nutzen remove_single_field / remove_multiple_fields
- Log Parser Builder: CSV, TSV, W3C and XML modes, several patterns per source, vendor format starting pointsLog Parser Builder: CSV-, TSV-, W3C- und XML-Modus, mehrere Patterns pro Quelle, Startpunkte für Herstellerformate
06 // personal finance
Personal finance
purpleteamfinance.comfree
PurpleTeam Financial Planner
A free, browser-based retirement planner I designed and built with Claude. Your data stays in your browser.
- Monte Carlo
- taxes
- Social Security
- Medicare
credential
FPWMP®
A personal-finance enthusiast with the FPWMP® credential. The PurpleTeam Discord is the place to talk about the planner.
PurpleTeam Discord ↗07 // travel
Travel
travel.log
2×around the world
50countries
Traveled around the world twice and visited 50 countries.
08 // contact
Contact
The best ways to reach me: