Blog / Research & Field Notes
Cybersecurity Insights, Incident Write-ups, Tooling Deep-Dives und Erfahrungen aus dem operativen Betrieb.
Alle Artikel auf Englisch · 9 veröffentlichte Beiträge
How Daybreak Blue changes secure code review and detection engineering in Codex, where it helps most, and why human validation still remains essential.
WebSSH started with a simple need: reach my servers from a browser without giving up control. This is how it grew into a self-hosted SSH and SFTP workspace, and where I deliberately draw its security boundaries.
CVE-2026-50656 is patched, but the fix ships as an engine update, not a Patch Tuesday KB. What RoguePlanet does, how it rhymes with BlueHammer, and the retrospective hunt and patch validation blue teams still owe themselves.
Microsoft Entra Agent ID secures the agents you build tomorrow. The service principals and managed identities you already run - the classic agents - are a different story. Two KQL detections, the diagnostic switch nobody flips, and what to do this week.
MSEM gives Sentinel something it never had: asset criticality and attack-path context per entity. Architecture, KQL patterns for incident enrichment, and the entity-matching pitfalls that quietly break them.
What we know about the BlueHammer zero-day, where the public exploit chain is fragile, and what blue teams can actually do today.
The Sentinel Data Lake Tier changes the cost equation for high-volume security logging. Architecture, migration playbook, KQL examples, and the pitfalls nobody warns you about.
A technical deep-dive into securing LLM-based agent deployments against prompt injection, data exfiltration, and tool abuse. Based on real-world hardening of OpenClaw-based systems.
How I built a FastMCP-based threat intelligence toolset that integrates VirusTotal, AbuseIPDB, Shodan, and MITRE ATT&CK mapping. The messy reality of building security tools, including the bugs.