Cybersecurity by day · open source by night

A place for my cybersecurity stuff.

Hi, I'm Shabran. Cybersecurity is what I do for work, and open source is what I'm a fan of on the side. This is where I share the freeware I build on my own time — have a look at what's below.

What I build

Tools, one instinct

Freeware built around problems I actually run into in cybersecurity work — some are ready, a couple are still cooking.

SOC case management

CaseSphere

Gives your SOC team a single pane of glass to triage alerts, investigate cases, track SLA compliance, and respond faster — with AI-powered analysis built in.

Open Source Self-hostable SIEM Integrations
Privileged access management

Brun PAM

Give your team SSH, RDP, and VNC access through the browser — every session recorded, every password redacted automatically, self-hosted and open source.

Open Source Self-hostable SSH · RDP · VNC
Security training range

RangeSphere

A self-hosted web-app hacking range for red and blue teams — spin up isolated vulnerable targets, hack from a live in-browser attacker box, and auto-verify the flag.

Self-hostedRed + Blue27 challenges
Threat intelligence

IntelSphere Coming soon

Collecting and making sense of threat intel, so it ends up useful instead of just saved.

In the works
The whole stack

SphereSuite Coming soon

The Sphere tools working together in one place instead of separate islands.

In the works
Inventory · stock tracking

Tally Coming soon

Keeping track of stock — what came in, what went out, and what's left on the shelf.

In the works
About

Shabran Alkhairi

FocusCybersecurity, mostly breaking things on purpose
ApproachFree core, open source first
CurrentlyAmericano or milk coffee, still deciding

Working in cybersecurity means alerts that never stop, tools that don't talk to each other, and a lot of 3 a.m. "is this real?" moments. SOC life is its own kind of tired, and most of us are quietly dealing with the same stuff. So I build small tools on my own time and share them for free, hoping they save someone a bit of that pain. A paid option might show up later, but that's still coming soon and nothing's locked away. Expect a few bugs, and please go easy on me, I'm still a newbie, hahaha. Let's help each other out, one cup of coffee at a time.

Whisper meme: someone whispers 'We're increasing the cybersecurity budget' into an ear, paired with a close-up of goosebumps on an arm

// the only time IT gets excited in a meeting

Let's talk over coffee.

Or just nerd out, I'm down either way.

Get in touch
Work

Projects

Free editions you can pull, read, and run yourself. CaseSphere's paid plans are coming soon, and a few more tools are on the way.

SOC case management

CaseSphere

A single pane of glass for triaging alerts, investigating cases, and tracking SLA compliance — with AI-powered analysis, SIEM integrations, and MITRE ATT&CK mapping built in.

Open Source Self-hostable SIEM Integrations
Privileged access management

Brun PAM

Puts a browser between your engineers and your infrastructure — every session recorded, every password redacted, every connection watched live. Built on Apache Guacamole's proven protocol engine.

Open Source Self-hostable SSH · RDP · VNC
Security training range

RangeSphere

A self-hosted web-app hacking range for red and blue teams — spin up isolated vulnerable targets, hack from a live in-browser attacker box, and auto-verify the flag.

Self-hostedRed + Blue27 challenges
Threat intelligence

IntelSphere Coming soon

Collecting and making sense of threat intel, so it ends up useful instead of just saved.

In the works
The whole stack

SphereSuite Coming soon

The Sphere tools working together in one place instead of separate islands.

In the works
Inventory · stock tracking

Tally Coming soon

Keeping track of stock — what came in, what went out, and what's left on the shelf.

In the works