198.51.100.77 - - [12/Mar/2025:16:50:31 +0000] "GET /....//....//etc/passwd HTTP/1.1" 403 162wazuh: rule 31151 level 6 · Multiple web server 400 error codes from same source ip203.0.113.24 - - [12/Mar/2025:16:50:33 +0000] "GET /.env HTTP/1.1" 403 162limit_req[perip] limiting requests, excess: 20.480 by zone "perip", client: 198.51.100.77node_cpu_seconds_total{mode="steal"} rate 5m -> 0.18wazuh: rule 5710 level 5 · Attempt to login using a non-existent user192.0.2.51 - - [12/Mar/2025:16:50:36 +0000] "GET /.git/config HTTP/1.1" 403 162soar: enrich 198.51.100.77 -> abuse_confidence=100 engines_flagged=12 · notify #opspredict_linear(node_filesystem_avail_bytes{mountpoint="/"}[6h], 86400) < 0wazuh: rule 31516 level 6 · Suspicious URL accesssemgrep: 0 blocking findings · gitleaks: no secrets · trivy: 0 critical198.51.100.77 - - [12/Mar/2025:16:50:41 +0000] "GET /.ssh/id_rsa HTTP/1.1" 403 162198.51.100.77 - - [12/Mar/2025:16:50:31 +0000] "GET /....//....//etc/passwd HTTP/1.1" 403 162wazuh: rule 31151 level 6 · Multiple web server 400 error codes from same source ip203.0.113.24 - - [12/Mar/2025:16:50:33 +0000] "GET /.env HTTP/1.1" 403 162limit_req[perip] limiting requests, excess: 20.480 by zone "perip", client: 198.51.100.77node_cpu_seconds_total{mode="steal"} rate 5m -> 0.18wazuh: rule 5710 level 5 · Attempt to login using a non-existent user192.0.2.51 - - [12/Mar/2025:16:50:36 +0000] "GET /.git/config HTTP/1.1" 403 162soar: enrich 198.51.100.77 -> abuse_confidence=100 engines_flagged=12 · notify #opspredict_linear(node_filesystem_avail_bytes{mountpoint="/"}[6h], 86400) < 0wazuh: rule 31516 level 6 · Suspicious URL accesssemgrep: 0 blocking findings · gitleaks: no secrets · trivy: 0 critical198.51.100.77 - - [12/Mar/2025:16:50:41 +0000] "GET /.ssh/id_rsa HTTP/1.1" 403 162

Le Duong Phi

Cyber Security Engineer

“You can't secure what you don't understand.”
Bruce Schneier

Read the handbook → View CV Get in touch

DevSecOps Engineer · Just Engineer Software Development
Blue Team · SOC · AppSec/DevSecOps · Cloud/Infrastructure Security
Hanoi, Vietnam

Contact

GitHub LinkedIn Facebook Email

The Security Handbook

From fundamentals to real operations

Every topic answers “what is this, and what problem was it built to solve” first, then goes into the mechanics, with commands and configs you can actually run. Each chapter ends with field notes: what was misunderstood at first, and what the work itself taught.

01 Networking 02 Linux 03 Windows & AD 04 Cryptography 05 AppSec (OWASP) 06 DevSecOps 07 CI/CD & GitOps 08 SIEM & Logs 09 Observability 10 SOC & IR 11 Network Defense 12 Pentest 13 Cloud 14 Containers 15 Threat Intel 16 GRC 17 Python

Open the handbook → Phiên bản tiếng Việt → Source on GitHub →

Scope of work

DevSecOps & secure SDLC: SAST · SCA · secret scanning · IaC scan in CI/CD · security gates · secure coding guidelines
Monitoring & detection: SIEM · infrastructure metrics · detection engineering · alert noise reduction
Response & automation: SOAR · threat intel enrichment · runbooks · incident handling process
Infrastructure & cloud: Hardening internet-facing services · IAM least privilege · secrets management · environment separation
Training & documentation: Secure coding · threat modeling (STRIDE) · abuse cases · internal documentation

Tooling Wazuh · Shuffle · Prometheus · Grafana · Zabbix · ELK · Acunetix · pfSense · Docker · Kubernetes · AWS · OCI · GCP · Python · Bash

Projects

Security Handbook↗ Bilingual security handbook, open source — this very site. github.com/fee-191/security-notes LynxGuard↗ A mini-SOC for web apps: Wazuh + Snort + ModSecurity on pfSense, real-time intrusion detection and blocking. SIEM · IDS · WAF · capstone project SecureBase↗ A DevSecOps template: SAST, secret scanning, dependency scanning and AI review wired into the CI pipeline. DevSecOps · CI/CD template CEX Incident Research↗ Analysis of 31 exchange breaches (2014–2025) — attack patterns, kill chain, MITRE ATT&CK mapping. threat intel · incident analysis