Skip to main content

Filed under

Threat Detection

6 entries

  1. Supply Chain 6 min read

    Investigating the Trivy Supply Chain Compromise with AI Agents

    How I used AI-assisted investigation to triage the trivy-action supply chain attack across my homelab repos — and some thoughts on weekend incident response and community notification gaps.

  2. Threat Detection 10 min read

    LLM-Powered Security Alert Triage with Local Models

    Automate security alert analysis using local LLMs (Ollama) for privacy-preserving incident response. Reduce alert fatigue with AI-powered triage without cloud dependencies.

  3. Threat Detection 11 min read

    SIEM for Homelab: Wazuh vs Graylog Performance Comparison

    Deploy and benchmark Wazuh and Graylog SIEM solutions in your homelab. Performance analysis, resource usage, and integration patterns for security monitoring.

  4. Monitoring 4 min read

    Building Your Own MITRE ATT&CK Threat Intelligence Dashboard

    Build MITRE ATT&CK threat intelligence dashboard with Python—track adversary tactics and techniques using open-source threat feeds.

  5. Threat Detection 16 min read

    Building a Network Traffic Analysis Lab with Suricata

    Deploy Suricata IDS/IPS for real-time network threat detection—configure rule management, performance tuning, and SIEM integration for homelab monitoring.

  6. Linux 17 min read

    eBPF for Security Monitoring: A Practical Guide

    Implement eBPF security monitoring for real-time kernel visibility—track syscalls and network activity with production-ready patterns for threat detection.