Two Months, Three Builds, One Retake: My November–December Plan
October was volume. November and December are about depth — fewer things, built further. Here's the plan, out loud, so you can hold me to it.
October was a sprint — 31 days of security habits, five Hacktoberfest builds, a challenge start to finish in public. The next two months are something different: depth over volume. This is the roadmap for the rest of 2026, and the whole point of building in public is that it's a promise you can check.
What I'm building
The Tiger Cloud SOC home lab. The big one. A detection lab that ingests real Windows event logs into a time-series database, runs anomaly detection over them, and surfaces the results in Grafana — the full pipeline a SOC actually runs, at home, on free and low-cost tooling. This gets two milestone posts: one when the ingestion pipeline is live, one when detection and dashboards are working. It's the most ambitious thing I've built, and the most directly SOC-shaped.
AlertCadence v2. My Hacktoberfest build that turns live CISA advisories into plain-English security briefs is getting a real upgrade — the improvements I parked while shipping v1 on a deadline. I said I'd deepen it if it proved useful; it did, so I will.
The ATT&CK alert-triage skill. A reusable artifact that takes a security alert, identifies the MITRE ATT&CK technique, and reasons through the attacker's likely next move and when to escalate — the Tier 1 triage logic a detection job actually asks for. (My Hacktoberfest "Rootkit Exorcist" build already pointed at a version of this; now I want the clean, documented skill.)
Three builds. Each one a rung on the detection ladder, not a scattered pile.
The exam
The SC-900 retake. I sat it in September and missed by a hair — 668 out of a 700 pass line. I've mapped exactly where the gaps were (Microsoft's security-solutions domain, and the question formats that punish "almost knowing it"), and I'm drilling both.
My date rule hasn't changed: I book on readiness, not the calendar. I'm targeting mid-to-late November, and the gate is clearing Microsoft's official practice exam comfortably — not squeaking — before I rebook. If that takes an extra week, it takes an extra week. I'd rather tell you the honest timeline than a brave one.
The quiet, constant layer
Free-tier training, ongoing. TryHackMe rooms, hands-on platforms, the kind of practice that doesn't make a headline but builds the actual muscle. I did my first CTF last month, and it reminded me how much the reps matter. This keeps going all through November and December — no bootcamp, no license, just the free tier and consistency.
Happening right now
I'm mid-build in the Meta Global AI Developer Hackathon (Oct 26–Nov 4), solo, in the Indie Developer Track. My project is The Unreliable Witness: an interactive cybersecurity investigation game built around one idea I care about a lot — evidence over confident AI.
Players work a fictional security incident: review the logs and evidence, question an AI investigation partner (powered by Meta's Muse Spark 1.3), and submit their own evidence-based verdict. The twist is the whole point — the AI isn't a reliable witness. It sounds confident; it isn't always right. To solve the case, you have to verify its conclusions against the actual evidence instead of taking its answer at face value.
That's the exact instinct a SOC runs on: investigative thinking, evidence analysis, alert triage, and knowing the difference between suspicious and confirmed. It's also my first time building on Meta's Model API — learning a new AI platform while applying the data-analytics background and the security knowledge I've been growing all year. The goal was never to let the AI solve the case. It's to get players to question AI-generated conclusions and build their own judgment.
Under the hood: Python · FastAPI · JavaScript · HTML/CSS · GitHub Codespaces · Meta Model API
Submission deadline is November 4 — right now I'm polishing, testing, and getting it ready to ship. A proper write-up comes after. Watch this space.
That's it. Three builds, one retake, steady reps, and I'll show the work on each as it happens — the wins, the dead ends, the real numbers, same as always.
Two months. Depth over volume. Hold me to it.
Storm to SOC — read the map, then move. 💜
Comments