ls ./writing

Writing

Field notes from the blue side and the red — detection engineering, infrastructure, tradecraft, and a certification path documented as it happens.

22 May 2026 2 min read

Why this site, why now

After twenty years of doing security work quietly, a few words on why I'm finally writing in public — and what I intend to put here.

meta
career

15 May 2026 5 min read

Building a university SOC: Wazuh, MISP and CrowdSec

Why I built a detection-and-response stack from open-source parts instead of buying one, how the enrichment loop fits together, and two lessons that only show up once it's running in production.

soc
detection-engineering
wazuh
threat-intelligence
blue-team