// detection engineering notes
Building detections that actually catch things.
Notes on writing high-fidelity detection rules, tuning noisy alerts, and thinking like an adversary before they think like one. Sigma, EDR telemetry, SOC workflows, and the occasional rant about false positives.
Recent posts
Writing detections for LOLBins without drowning in noise
A practical approach to scoping process-lineage detections so they survive contact with a real environment.
Read post →Alert fatigue is a detection engineering problem
Why tuning belongs in the detection lifecycle, not as an afterthought for whoever is on shift.
Read post →Hunting for living-off-the-land persistence
Turning a one-off hunt into a repeatable detection with measurable coverage.
Read post →