Latest posts
View all →Breaking Out of the AppSec Bubble
There is a comfortable lie that application security professionals tell themselves. We harden the code, we run the threat models, we catch the SQLi in code review — and somewhere in the back of our minds we assume that is where our responsibility ends.
Read post upcomingEndpoint Visibility: Wazuh and the Windows Log Problem
Out of the box, Windows event logging is nearly useless for threat hunting. Here is what Sysmon changes, and how to get all of it flowing into a SIEM.
upcomingSimulating Attacks and Hunting for Them
Running Atomic Red Team techniques mapped to MITRE ATT&CK, then hunting for evidence across Suricata, Zeek, and Sysmon logs. The core SOC learning loop in practice.