Hanane Bayen

Enhanced Datadog’s Cloud SIEM platform by expanding Risk Insights to support Azure‑native entities. • Integrated Azure audit logs to generate risk events and surface suspicious activity through entity‑based risk scoring. • Improved threat investigation workflows by fixing related log visibility and implementing contextual notification links for Azure signals. • Contributed to internal rollout of new detection and triage capabilities for multi‑cloud environments, aligning with MITRE ATT&CK. • Tools: Go, Javascript, DDSQL, Cloud SIEM, Azure, GCP, AWS.

• Optimized SIEM use cases by implementing whitelisting, blacklisting, and threshold tuning to reduce false positives. • Created watchlists and improved event correlation to strengthen detection capabilities. • Parsed and normalized event data to extract critical indicators and refine detection rules for higher accuracy. • Tools: Microsoft Azure, Microsoft Sentinel, KQL, Azure Log Analytics.

Deployed and configured a SIEM solution using Wazuh for real‑time monitoring and threat detection. • Created and fine‑tuned alert rules to detect suspicious activities and anomalies. • Simulated various web attacks (e.g., brute force, SQL injection) to test detection capabilities. • Tools: Wazuh, DVWA, Hydra, Nikto, Linux