Taming CloudTrail in Chronicle
Cutting 99% of AWS CloudTrail ingestion volume during a SIEM migration.
Security Guardrails for AI Development
A leaked Shodan key led to a security workflow for AI coding agents.
MITRE Coverage Beyond the Green Matrix
Why technique heatmaps lie about detection coverage, and how to fix the loop.
Graft 2: The AI Engineering Workflow
How I built Graft using Gemini and disciplined AI workflows.
Graft 1: Detection-as-Code, Implemented
Engineering decisions behind Graft, a Detection-as-Code platform.
Prepare Your SOC for AI
The readiness work that makes AI pay off in a SOC.
Lantana 2: The Data Pipeline
Building Lantana's data pipeline and first end-to-end deployment.
Pragmatic Adversary Engagement Framework
A pragmatic framework for running Adversary Engagement programs.
Review: Intrusion Detection Honeypots
Detection through deception made simple.
SOAR Playbooks Aren't Scripts
Treating SOAR playbooks as pipelines, not scripts.
Detection-as-Code, Then What?
Real gains from a Detection-as-Code project.
High-Fidelity NRD Detections
Implementing high-fidelity detection rules for Newly Registered Domains (NRDs) in Google SecOps.
Gap Analysis with MITRE Navigator
Automate MITRE ATT&CK gap analysis combining Navigator layers.
Auto-Cleaning Data Tables in Chronicle SIEM
Automate Chronicle SIEM Data Tables cleanup for expired rows.
Mapping Detection Rules to MITRE ATT&CK
A guide to map detection rules to MITRE ATT&CK.
