Noa Matout Français

I operate.I measure.I write.

≈ 1,300 workstations migratedworkstations 150 Linux VMs 30 Windows VMs 100% of contractor access goes through the bastionbastion 2 of my controls proven wrongflaws

I sort out what matters.

Sentinelle, my triage tool for Windows logs. The rules detect; the model only explains.

Windows server, then 5,486,961 events read. Event store, then 185,232 evaluated. Sigma rules, then 1,111 detections. Noise reduced, then 5 visible alerts. Local LLM (planned). Incident story (planned). rules, no modelthe model, afterwards 5,486,961 events read 185,232 evaluated 1,111 detections 5 visible alerts Windows server EVTX logs Event store none discarded Sigma rules 1,762 variants Noise reduced 9 alerts in AI Local LLM cases and verdicts, planned Incident story on demand, planned Windows server, then 5,486,961 events read. Event store, then 185,232 evaluated. Sigma rules, then 1,111 detections. Noise reduced, then 5 visible alerts. Local LLM (planned). Incident story (planned). rules, no modelthe model, afterwards 5,486,961 events read 185,232 evaluated 1,111 detections 5 visible alerts Windows server EVTX logs Event store none discarded Sigma rules 1,762 variants Noise reduced 9 alerts in AI Local LLM cases and verdicts, planned Incident story on demand, planned

What is left to read

5

visible alerts, once the noise is handled by justified, dated exceptions. No threat.

Why they remain

Two are my own administrator actions, run to check the logging. Three concern executions whose parent process Sysmon had lost: an exception based on the parent cannot hide them, and that is intended.

What the server was logging

The command line of created processes went from 0% to 100% after hardening, a switch visible to the hour.

One Windows test server, exported twice. The dotted steps are planned: no figure appears on them.

Detection decides, AI explains.

01 · My articles

I write up the trials, the mistakes
and the limits.

The measurement matters as much as the result.

A protection I never saw refuse anything does not exist

I built a private site, then tried to prove it was leaking: two of my protections did not hold.

01First control: nothing from the content may reach the browser

My texts live in typed files, imported only by components rendered on the server. In theory, no sentence can end up in the JavaScript sent to the browser. In theory.

Read this article
02Second control: refuse what comes from elsewhere

My login page refuses requests coming from another site. I wrote the control and tested it from the command line with a foreign origin: refused. With the right origin: accepted. Green control.

Read this article
03The limit I know of

These checks prove the absence of what I know how to look for. They do not prove the absence of a leak. Data leaving by a path I have not thought of would pass green without any trouble.

Read this article

Read my other articles, in French

02 · My projects

Two broad accesses,
now bounded.

Each record states its problem, my role, my choice, its proof and its limit.

I bound contractor access

The problem
I had to replace contractors’ VPN access with access limited to their intervention.
My role
I led the project alone, from the study to maintenance.
My choice
I chose Apache Guacamole for browser-based access with session recording.
Coverage
100% of contractor access goes through the bastion.
The limit
I have neither the commercial support nor the secret discovery and rotation features of paid privileged access management products.

I take back control of an inherited access

The problem
I had to replace an unsecured VNC access, deployed long ago by an old script.
My role
I replaced that access with centralised remote control.
My choice
I chose MeshCentral, with named accounts and multi-factor authentication.
The scale
I migrated about 1,300 workstations, with one month of coexistence and a deployment through group policy.
The limit
I also have to maintain the agent installed on the workstations, and check how it behaves when it loses contact with the console.

03 · My background

What I run,
in numbers.

150Linux virtual machines

on VMware vSphere. I automate the management of the Linux fleet with Ansible.

30Windows virtual machines
800TOEIC self-reported

taken on .

Systems, network and security engineer in Reims. 23 years old. Before 2021, I did a civic service in digital inclusion and a three-year apprenticeship in winegrowing. I retrained in IT in 2021.

My experience

  1. Systems, network and security engineer, freelance

    / Today

    Supplay

  2. Network and systems engineer

    /

    Supplay

  3. Co-founder

    / Today

    ZON

  4. Network and systems administrator

    /

    Supplay

  5. IT maintenance and support officer

    /

    Supplay

My education

  1. Master’s degree in IT security (Mastère)

    /

    French level 7 certification: IT Engineering Expert

    ESGI · Awaiting validation

  2. Bachelor’s degree in IT security

    /

    French level 6 certification: Systems, Network and Security Project Manager

    ESGI

  3. Systems and networks training

    /

    CESI

  4. Vocational baccalaureate in vineyard and winery management

    /

    CFA d’Avize

What I work on

  • Systems and network operations
  • Automating procedures with AI
  • Security applied to automation

04 · Contact me

Let’s talk about a job,a mission,or an article.

Send me an email

I am available for a job or a freelance mission. For the details, write to me.