hello, world
Why this site exists, what I plan to write here, and how the whole thing ships.
Blue team engineering, threat intel, and the automation turning point.
I defend networks for a living — detection engineering, CTI, and the operational glue between tools. Automation is changing what a small defensive team can do, and I'm writing down what actually works.
# tip: press ` anywhere — this site has a console # tip: tap `console in the header — this site has a shell
~/writing view all →
~/attack-map what the writing covers
recon
res-dev
init
exec
persist
privesc
evasion
creds
disco
lateral
collect
c2
exfil
impact
0/76 techniques
covered · lit cells link to the writing
# tag posts with techniques: ['T1566'] frontmatter to
light the map
~/projects view all →
detect/
detection-notes wip
Public detection engineering notes: rules and hunting queries mapped to ATT&CK, with the false-positive war stories included.
intel/
cti-lab active
Self-hosted threat intelligence stack — OpenCTI, MISP, and the collection pipelines that feed them.
automate/
glue active
Automation patterns for SOC workflows: enrichment, triage, and the boring plumbing that gives analysts their hours back.
~/signals newest known-exploited vulns
CVE-2026-118527IvantiConnect Secure — Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
CVE-2026-111357IvantiConnect Secure — Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
CVE-2026-97229GitLabCommunity Edition and Enterprise Edition — GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound Vulnerability
CVE-2026-76418CiscoSecure Firewall ASA Software and Cisco Secure FTD Software — Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Return Value to NULL Pointer Dereference Vulnerability
CVE-2026-41709BroadcomVMware ESX — Broadcom VMWare ESX Insufficient Logging Vulnerability
CVE-2026-46300LinuxKernel — Linux Kernel Missing Initialization of a Variable Vulnerability