I build free, open-source tools that help engineers troubleshoot Azure cloud monitoring and web security. What used to take hours of investigation takes seconds.

I work across cloud observability, edge security, and IoT hardware, building offline-first diagnostic tools, serverless security layers, and DIY smart home devices. Everything I ship is open source, privacy-first, and runs at zero cost. Mostly troubleshooting, fixing things, and building what should already exist.

---

Featured

Note

A curated collection of diagnostic and validation tools for the Azure Monitor data collection pipeline: DCR validation, syslog/CEF analysis, AMA network diagnostics, log ingestion troubleshooting, and AI-powered threat hunting.

All free. All offline. All open source.

---

Selected Work

_{(click to expand)} Azure Monitor & Sentinel: diagnostic and validation tools for Azure's data collection pipeline

These tools tell you exactly what's wrong when syslog messages aren't arriving, DCRs are silently dropping data, or the Azure Monitor Agent can't connect.

• dcr-kql-validator: DCR & KQL Transformation Validator

  • Offline desktop tool for validating Data Collection Rules and KQL transformation queries before deployment.
  • Built with Rust + Tauri. ~8 MB binary, 3 direct dependencies, zero network calls.
  • Validates ~90 allowed KQL scalar functions, detects blocked operators, checks TimeGenerated output.

• SyslogCEFAnalyzer: Syslog & CEF Message Format Analyzer

  • Drop in a .pcap or log file and instantly see which messages are valid, malformed, or missing fields.
  • 8 automated diagnostic rules: format detection, PRI validation, RFC 3164/5424, CEF, Cisco ASA/FTD, encoding, transport.
  • TCP stream reassembly, streaming pcap reader (up to 2 GB), drill-down UI. Zero NuGet packages.

• AMANetworkAnalyzer: AMA Network Trace Analyzer

  • Diagnose Azure Monitor Agent connectivity issues from pcap/pcapng/etl/cab captures.
  • 7 diagnostic rules: endpoint connectivity, DNS resolution, firewall blocking, proxy detection, TLS/cipher compliance, Private Link/AMPLS detection.
  • Supports Azure Commercial, Government, and China sovereign clouds.

• azure-logs-ingestion-api-troubleshooter: Logs Ingestion API Troubleshooter

  • Step-by-step Bruno API collection for diagnosing DCR stream declaration mismatches, column misalignments, and ingestion failures.
  • Pre-flight schema diff compares your JSON payload against the DCR before sending.
  • Includes a one-command demo environment deployment script.

• azure-bruteforce-defense: AI-Powered SSH Threat Hunting

  • Ask "Who's attacking my server?" and Azure OpenAI queries your logs, then answers with structured analysis.
  • Full-stack: Ubuntu VM with Fail2ban + Azure Functions + Microsoft Sentinel + GPT-4o-mini.
  • Zero hardcoded secrets. All auth goes through managed identity.

• cf-log-ingestion: Cloudflare WAF to Azure Log Analytics

  • Automated pipeline: Cloudflare GraphQL API, Python Azure Function, DCR, custom table (23 columns).
  • 42 ready-to-use KQL queries (dashboard, alerts, threat hunting, ML anomaly detection) and a deployable Azure Monitor Workbook.
  • Runs within Azure free tier for low-traffic sites.

_{(click to expand)} Cloudflare Edge Security: lightweight security tools on Cloudflare Workers (free tier)

Zero JavaScript on the client, zero cookies, zero tracking.

• cf-bot-guard: Bot Detection & Analytics

  • Scores every visitor 0-100 using 16 detection signals. Classifies ISPs by type (hosting, mobile, residential, education, corporate).
  • Privacy-respecting analytics stored in KV with a built-in 22-panel HTML dashboard. No cookies, no JS, no PII.
  • Transparent proxy that adds intelligence headers (x-bot-score, x-isp-type) without blocking.

• cf-email-domain-decoy: Decoy Landing Page

  • Cryptic, minimal page for email-only domains with Moroccan geometric CSS art and bot fingerprinting.
  • Zero JavaScript, zero external resources, zero PII exposure. Every path returns identical content.

• blog-guard: Static Site Path Allowlist

  • Allowlists valid paths via KV and redirects everything else to the homepage, a silent bot trap through the rate limiter.
  • Defence-in-depth: WAF, Bot Fight Mode, Rate Limiting, blog-guard.

_{(click to expand)} ESP32 & Smart Home: DIY hardware projects using ESPHome and Home Assistant

Because paying shop prices for smart home gear is daft.

• esp32-a1s-sendspin: Multi-Room Audio

  • Working ESPHome config for the ESP32-A1S Audio Kit with Sendspin protocol for synchronised multi-room playback via Music Assistant.

• esphome-air-quality-monitor: Air Quality Monitor

  • CO2, temperature, humidity & VOC monitoring on the Cheap Yellow Display (ESP32-2432S028) with a custom LVGL touchscreen UI.
  • Memory-optimised for ESP32 without PSRAM (~45-50 KB LVGL footprint).

• esp-thread-border-router: Thread Border Router

  • ESP32-S3 + W5500 Ethernet module = a Thread Border Router with wired backhaul for about £15.
  • Replaces a £130 Apple HomePod or Google Nest Hub for Matter-over-Thread devices.

• diy-streaming-key-light: Streaming Key Light

  • A ~£25 bi-colour LED panel with full CCT control (3200K-5600K), Home Assistant integration, and a local web UI.
  • Replaces a £200 Elgato Key Light.

---

Languages & Tools

Languages

Platforms

Infrastructure

---

Get in touch

---

_{Everything runs offline or on free tiers. No telemetry, ever. Projects are MIT licensed unless the repository states otherwise.}