/ writing · 04 posts

Notes on detection and operations.

Practical writing on SOC work — detection engineering, shift leadership, and the tools that support both. No hot takes; just what I've seen work.

/ series · 04

Recurring threads.

Most writing here lives in one of these threads. Subscribe to a single series via RSS or all of them at /rss.xml.

Investigations

End-to-end walkthroughs of synthetic SOC alerts — what I checked, why, and what closed it.

Attack Walkthroughs

Step-by-step technique breakdowns: how a TTP works, what telemetry catches it, and where detections fail.

Cybernews

My read on the week's big security news — what changed, what to do about it.

Project Notes

Build logs and deep dives on the tooling I ship — design decisions, tradeoffs, lessons.

Date

Title

Excerpt

Read