Find the weakness.
Build the answer.

Every command below is also a plain link. Use the keyboard or the mouse, whichever you prefer.

rightrice@dev:~$ whoami
rightrice. L2 Technical Analyst; builds security tooling and software.
offensive security · network infrastructure · software
available for freelance penetration testing and security work

rightrice@dev:~$ ls -l work/

drwxr-x---homelab/ongoingsonicwall / linux / snmp drwxr-x---mapleai/in-developmentsecurity tooling / ai drwxr-x---sapwatch/in-developmentsiem / log pipeline

rightrice@dev:~$ cat work/mapleai/README.md

# MapleAI
Bringing local intelligence to security work.
Local models that use technical knowledge and system tools
inside an authorized testing scope.
stack   ibm-granite · ollama · local tooling
status  active internal development
open    retrieval quality · tool execution · scope handling

Built from curiosity.
Grounded in practice.

A closer look at what I’m building, exploring, and putting to work.

work/homelab/ongoing

Infrastructure / SonicWall / Linux

The home lab

A full SonicWall firewall and a Linux server, set up to test assumptions about networks, security controls, and the systems behind them.

firewallSonicWall

Zones and VLAN segmentation
VPN
Security services: Intrusion Prevention, Gateway Anti-Virus, Anti-Spyware, App Control, Content Filtering, Capture ATP
DPI-SSL inspection, logging, and reporting
SNMP monitoring
SAML for user login
VoIP configuration
Geo-IP blocking
Bandwidth controls
Templates for quick installs
Security Insight enhancements

serverLinux

Self-hosted Linux services
Storage and backups

How I use it

Attack practiceAttacking my own systems as hands-on prep for the CPTS.
Detection and loggingReviewing the logs and alerts my own attacks produce.
Network monitoringSNMP, device telemetry, and dashboards.
HardeningBaselines, firewall rule reviews, and patch cycles.

Inside the lab

My lab brings together SonicWall firewalls, wireless infrastructure, Linux systems, and monitoring. It gives me a place to experiment with segmentation, troubleshoot device telemetry, and work through security scenarios.

Current areas of exploration include SNMP monitoring, firewall configuration, and local AI tooling on Kali Linux.

work/mapleai/in development

Security tooling / AI

MapleAI

Bringing local intelligence to security work.

A project exploring how local language models can use technical knowledge and system tools within an authorized testing scope.

IBM Granite
Ollama
Local tooling

Explore the project

The problem

A model that only produces text cannot carry out a practitioner’s workflow. Useful assistance needs access to relevant knowledge, local tools, and clear scope boundaries.

What I’m working on

A knowledge pipeline for technical writeups, local model experimentation, and tool integration. The goal is to interpret engagement scope and support authorized security testing.

Current stage

Active internal development. Retrieval quality, tool execution, and scope handling are areas of ongoing work.

Engagement scopeTechnical knowledge

Local modelIBM Granite + Ollama

System toolsPractitioner review

Scope-aware by design

work/sapwatch/in development

Security monitoring / SIEM

SapWatch

A multi-tenant SIEM that turns firewall, network, and endpoint logs from many sites into one clear security picture.

SapWatch collects telemetry from firewalls, wireless networks, endpoints, and cloud security tools, normalizes it into one event format, and runs detections across it. Each client gets a read-only view of their own alerts and the health of their sources, and nothing more.

Python
Vector
OpenSearch
Redpanda
PostgreSQL
Wazuh
Sysmon
Sigma

Explore the project

What it collects

SonicWall and FortiGate firewall syslog, UniFi network events, SNMPv3 device health, and NetFlow/IPFIX traffic records. Windows and Linux endpoints report through Wazuh, with a version-controlled Sysmon configuration and Linux audit rules. Huntress EDR incidents and Microsoft 365 audit logs (sign-ins, directory and mailbox changes, file activity) come in through their cloud APIs.

How it works

A collector at each site receives syslog, buffers it to disk, and forwards it over mutual TLS. A central ingestion gateway authenticates every collector, enforces tenant boundaries, and audits what it accepts. Events are normalized and deduplicated, then checked by a shared detection engine that runs SapWatch’s own rules alongside SigmaHQ’s community rules for Windows and Linux. Results are indexed for search and pushed to the client portal in batches that are safe to retry.

Security by design

Every integration has tenant-isolation tests. Collector credentials are stored as SHA-256 hashes, checked in constant time, and can be rotated or revoked. The client view is read-only: clients see alerts and source health but cannot change collectors, detections, or retention.

Current stage

In development, with over 300 Python modules and about 100 test files. Parsers, detections, and pipelines are tested offline against sample data; validation against live hardware and vendor accounts comes next.

Firewalls & Wi-FiEndpointsCloud tools

Ingestion gatewayauth · tenancy · audit

Normalize & detectSearch & alerts

Read-only client view

Curiosity, put to work.

A cybersecurity professional with a developer’s mindset and a hands-on approach to systems.

I work as a Level 2 Technical Analyst and build my own software and cybersecurity projects. My interests span red-team work, network infrastructure, and iOS development.

I’m drawn to the work that happens beneath the surface: understanding a protocol, tracing an unexpected result, or building a tool that makes a difficult task easier.

Skills and tools

Network security: SonicWall (SNSA certified) · zones and VLANs · VPN · DPI-SSL · Geo-IP blocking · bandwidth controls · SAML login · VoIP · Cisco CCNA in progress
Systems: Linux services · storage and backups · SNMP monitoring · Kali Linux
Offensive security: Attack practice in my own lab · Hack The Box CPTS in progress
Defense: SIEM pipelines · detection rules, including Sigma · logging and detection · hardening and patching · firewall rule reviews
Software and AI: iOS development · local language models with IBM Granite and Ollama

How I think

/ 01 · offensive security

Think like an attacker.

Question the assumptions. Follow the attack surface. Look for the gap between how a system is intended to work and how it actually behaves.

/ 02 · systems & networks

Know the infrastructure.

Understand the network, the endpoints, and the dependencies. Good security decisions start with knowing what keeps the environment running.

/ 03 · software & iOS

Build with purpose.

Turn recurring problems into tools. Bring a developer’s perspective to testing, automation, and the software people depend on.

Freelance penetration testing
and security work.

Available for freelance engagements. Testing only happens with written authorization and an agreed scope.

offense

Penetration testing

Network and web application testing that looks for the gap between how a system is meant to work and how it actually behaves.

network

Firewall and network reviews

SonicWall configuration reviews covering zones, VLAN segmentation, VPN, security services, and firewall rules.

detection

Logging and detection

Getting firewall, endpoint, and cloud logs into one place, then writing detections for the activity you care about.

defense

Hardening

Baselines, patching, and configuration reviews for networks and Linux servers.

How an engagement works

ScopeWe agree in writing on targets, timing, and rules of engagement.
TestI test only what is in scope and tell you right away if something critical turns up.
ReportYou get findings ranked by risk, with clear steps to fix each one.

Start a conversation

Have something in mind?

For freelance penetration testing and security work, project inquiries, or questions.

Find the weakness.Build the answer.

Built from curiosity.Grounded in practice.

The home lab

firewallSonicWall

serverLinux

How I use it

MapleAI

The problem

What I’m working on

Current stage

SapWatch

What it collects

How it works

Security by design

Current stage

Curiosity, put to work.

Skills and tools

How I think

Think like an attacker.

Know the infrastructure.

Build with purpose.

Freelance penetration testingand security work.

Penetration testing

Firewall and network reviews

Logging and detection

Hardening

How an engagement works

Have something in mind?

Find the weakness.
Build the answer.

Built from curiosity.
Grounded in practice.

Freelance penetration testing
and security work.