$ whoami
Muhamad Faishol Hakim
DFIR engineer · Indonesia
I do incident response and digital forensics for enterprise clients in Indonesia, most of them state-owned. In practice that means acquiring evidence, working out what happened from disk and memory, and writing it up for people who have to act on it.
Three years and change: one in a SOC, the rest consulting. More than ten engagements so far: ransomware, web compromise, cryptomining. I also implement Splunk, Elastic and Tenable for clients, and write Python to shorten the parts of an investigation that are the same every time.
What I work on
- Forensics and incident response
- Disk, memory and cloud instance acquisition. Chain of custody, timeline reconstruction, root cause. Reports for both the engineers remediating and the executives signing off.
- Threat intelligence and detection
- IoC extraction and enrichment, ATT&CK mapping, and detection content built and tested on Splunk and Elastic.
Experience
Jan 2025 — present
Technical Consultant Associate
PT FPT Metrodata Indonesia · Metrodata Group
- Primary investigator on 10+ DFIR engagements across telecom, finance, manufacturing and construction.
- Implement and maintain Tenable, Splunk and Elastic for clients, from deployment through handover.
- Write the incident reports: timeline, root cause, findings, remediation.
- Test blue team tooling and bring what works into how the team runs engagements.
Feb 2024 — Jan 2025
Technical Consultant Associate
PT Mitra Integrasi Informatika · Metrodata Group
- Implemented security products for enterprise clients and supported them after deployment.
- Ran forensic investigations: evidence acquisition, chain of custody, timeline reconstruction.
Feb 2023 — Feb 2024
Technical Consultant Analyst
PT Mitra Integrasi Informatika · Metrodata Group
- Researched Splunk and Elastic and turned it into blue team use cases the team used on client work.
- Wrote the deployment and configuration documentation.
Mar 2022 — Feb 2023
Cyber Security Analyst (L1)
PT Visionet Data Internasional
- Monitored and triaged alerts across SIEM, EDR and IAM for several client environments.
- Built security awareness material and ran technical briefings.
Cases
| Incident | Sector | Scope |
|---|---|---|
| Web compromise | Telecommunications | Linux server |
| Ransomware | Manufacturing | Windows estate |
| Ransomware | Finance | Windows estate |
| Ransomware | Construction | Windows estate |
| Cryptomining | Food & beverage | Cloud instance |
| Readiness assessment | Financial services | Pre-incident review |
Tools
- Forensics
- KAPE, Velociraptor, Volatility, FTK, Autopsy, EZTools, Hayabusa
- SIEM & EDR
- Splunk, Elastic, CrowdStrike, Wazuh
- Intelligence
- Recorded Future, MISP, OpenCTI, Trend Vision One
- Validation
- Tenable, Atomic Red Team, MITRE ATT&CK
- Engineering
- Python, Bash, Linux, Windows, Git
Certifications
| Computer Hacking Forensic Investigator (CHFI) | EC-Council |
| Splunk Enterprise Security Certified Admin | Splunk |
| Digital Forensic Essentials (DFE) | EC-Council |
| Foundation Level Threat Intelligence Analyst | CREST / APMG |
| Operationalizing MITRE ATT&CK | AttackIQ |
Competitions
| KC7 CTF | KC7 Foundation | 2nd |
| Rise the Ranger CTF | Siber TNI | 4th |
| GEMASTIK | National, Indonesia | top 7 · finalist ×2 |
| Dragos CTF | ICS/OT and DFIR | 19th of 700+ |
| Holmes CTF 2026 | Hack The Box | 37th |
| JOINTS UGM | CTF | finalist ×2 |
| CBD | CTF | finalist |
Side projects
Things I am building for my own workflow. Early stage — closer to ideas than finished tools.
dfir-autopilot
earlyTriage pipeline: KAPE collection, artifact parsing, Hayabusa and DeepBlueCLI scanning, into one timeline.
Python · KAPE · Hayabusa · DeepBlueCLI
vol-autoparser
earlyVolatility 3 wrapper for Linux memory images — detects the kernel, fetches ISF symbols, runs the relevant plugins and summarises what came back.
Python · Volatility 3
tmv1-automate
earlyBulk IoC upload and parallel multi-tenant sweeps against the Trend Micro Vision One API.
Python · Vision One API
Writing
Older posts are on Medium. These three are drafted and not published yet.
Automating DFIR triage with KAPE and timeline analysis
What the pipeline catches, and what it still misses.
A Volatility auto-parser for Linux memory images
Kernel detection, ISF symbols, plugin orchestration.
From intel report to deployed detection
IoC extraction, enrichment, and pushing it out across tenants.
Contact
Incident response, forensics, or anything in this field — email is best, LinkedIn works too.