~/projects
Things I build and maintain. Mostly reusable tooling — runbooks, pipelines, and lab infrastructure — because one-off fixes don't scale.
detect/
detection-notes wip
Public detection engineering notes: rules and hunting queries mapped to ATT&CK, with the false-positive war stories included.
intel/
cti-lab active
Self-hosted threat intelligence stack — OpenCTI, MISP, and the collection pipelines that feed them.
automate/
glue active
Automation patterns for SOC workflows: enrichment, triage, and the boring plumbing that gives analysts their hours back.