Thoughts on security engineering, automation, and building resilient systems.
A home-lab SOC on GCP, provisioned entirely as code with OpenTofu and Ansible: a bastion-less network, a private Wazuh SIEM, a deliberately vulnerable target, a custom detection rule, and an edge router that safely publishes it to the real internet.
Building a system that not only detects unencrypted S3 buckets but uses Gemini AI to explain vulnerabilities in plain English. Learn how to combine AWS Lambda, AI, and automated monitoring to make security insights accessible to everyone on your team.
An in-depth analysis of how Model Context Protocol servers can become confused deputies, potentially enabling privilege escalation attacks. We explore the security implications and defense strategies for this emerging threat vector in AI systems.
A practical guide to developing machine learning-based threat detection pipelines that reduce false positives and improve mean time to detection. Learn how to integrate ML models with traditional SIEM platforms for enhanced security monitoring.
Key insights from building SOAR workflows in GCP environments. Covering architecture patterns, common pitfalls, and strategies for effective security orchestration and automated response.
A comprehensive guide to creating detection rules for network intrusion detection systems. Includes real-world examples for CVEs like Exchange Server vulnerabilities and F5 BIG-IP authentication bypass, with PCAP analysis techniques.