SOAR Playbooks Aren't Scripts
Treating SOAR playbooks as pipelines, not scripts.
Going YOLO With Claude Code
Two days of full-permission Claude Code, and a close call.
Detection-as-Code, Then What?
Real gains from a Detection-as-Code project.
AI-First Software Development
Transitioning from ad-hoc scripting to an AI-first development workflow.
Review: Virtual Honeypots
A book review of the 2007 classic 'Virtual Honeypots.'
High-Fidelity NRD Detections
Implementing high-fidelity detection rules for Newly Registered Domains (NRDs) in Google SecOps.
Why I Switched to Quarto
My journey migrating from Zola to Quarto.
Gap Analysis with MITRE Navigator
Automate MITRE ATT&CK gap analysis combining Navigator layers.
Auto-Cleaning Data Tables in Chronicle SIEM
Automate Chronicle SIEM Data Tables cleanup for expired rows.
CISSP Year 5: Reflections
The practical impact of the CISSP certification.
Cordyceps: The Making of Rust Ransomware
An educational Rust ransomware for security research.
Reflections on Using LLMs to Learn Rust
Using LLMs as a learning tool for programming.
Rust for Security Engineers
Rust language from a security engineer's perspective.
Mapping Detection Rules to MITRE ATT&CK
A guide to map detection rules to MITRE ATT&CK.
Engineering Detection Rules
Engineer threat detection rules: design, document, then code.
