Resources
Notes on detection engineering, threat hunting, and telemetry pipeline architecture from the field. No gated forms, no fluff.
Blog
detection-engineeringmachine-learningllmlocal-inference
Building a Synthetic Attack Data Generator, Part 2: Wiring Up Local Narrative Generation
Getting Qwen3 8B in LM Studio to paraphrase fixed facts without inventing threat characterizations, and the debugging path to get there.
Blog
detection-engineeringmachine-learningcriblmitre-attack
Building a Synthetic Attack Data Generator, Part 1: Schema and the FP Problem
Designing a labeled log/alert dataset for SOC triage classification, and why false positives need to be built on purpose.