Blogs: ideas, lessons, and field notes.
A space for practical thoughts on cybersecurity, AI, detection engineering, SOC operations, product building, and the lessons learned while working close to real security challenges.
I got tired of waiting for attacks to test my detection rules
You write a Wazuh rule, and then you wait for something to trigger it. Maybe that happens this week. Maybe the rule sits there with a typo in it for two months. LogGen is what I built to close that gap.
Testing a Wazuh rule end to end without waiting for an attack
Prove the pipe before you trust a rule, remember that Wazuh does not listen for syslog by default, read the archives log before the alerts log, and always test the negative case. Most of the time lost onboarding a log source goes on not knowing which half of the chain is broken.
Getting log formats right is the whole job
A detection rule written against a format that does not match the real device passes in the lab and never fires in production. Notes from building 16 log sources: CEF that is not CEF, positional CSV where order is everything, and a published sample that turned out to be hand edited.
You Have ISO 27001. How Much SOC 2 Is Already Done?
All 93 Annex A controls mapped to SOC 2. A complete ISMS covers 36 of 61 criteria and 231 of 330 points of focus. The gap is almost entirely privacy.
There Is No List of SOC 2 Controls
SOC 2 publishes 61 criteria and 330 points of focus, and exactly zero controls. What the standard actually contains, and how to run readiness against it.
10 Cybersecurity Case Studies Every Security Engineer Should Study
Ten cybersecurity case studies every security engineer should study, what happened, how it unfolded, and the key lesson.
MITRE ATLAS: The Security Framework Built for the Age of AI
Learn what MITRE ATLAS is, how it works, and why every security team needs it. The complete guide to defending AI systems against real-world adversarial attacks
What is an Agentic AI SOC Analyst? A Comprehensive Guide
Learn how Agentic AI SOC Analysts automate threat detection, investigation, and response, transforming modern SOC operations with AI-driven security.
Essential SOC Tools and Technologies
Explore the essential tools used by SOC analysts, including SIEM, EDR, SOAR, TIPs, XDR, CSPM, UEBA, and vulnerability scanners.
AI in Modern Email Security
Discover how AI enhances email security through phishing detection, threat analysis, anomaly detection, and automated response.