Secure SleuthsNotes · Post-mortems · Essays · Guides
What we see, written down.
Anonymized post-mortems, opinionated essays, and the occasional 40-minute guide. No newsletter spam. The first notes are being written now, here is what is on the way. We publish when we have something worth saying, not before.
Note8 on the way
FIELD NOTE14 min read · drafting
The OAuth grant we almost missed, a 3,200-word post-mortem.
ESSAY9 min read · drafting
Why your MSSP's dashboard is lying to you (respectfully).
TECHNICAL18 min read · drafting
Tuning Wazuh for AWS CloudTrail without drowning your analysts.
FIELD NOTE11 min read · drafting
A stale PAT, a rented VPS, and 47 days of quiet access.
ESSAY6 min read · drafting
The EPS trap, in one chart you can send your CFO.
TECHNICAL22 min read · drafting
MISP plus TheHive: a 40-minute pipeline that actually works.
FIELD NOTE7 min read · drafting
What an audit-day looks like when the logs are already there.
ESSAY8 min read · drafting
Stop measuring MTTD. Measure what you'd miss without it.
Signal, not noise
Want the first note when it lands?
No list to sign up for yet. Drop us a line and we will send the first one straight to you.