Hello World

About the Blog

I spend a lot of my time responding to incidents, writing and tuning detections, identifying and resolving misconfigurations, and hunting in the cloud. After a while you start to notice the same patterns, the same misconfigs, and the same threats. I figured I’d start writing some of it down.

This blog is mostly a place for me to document things I’ve seen, techniques that caught my attention, queries that I thought were neat, and whatever else comes to mind. Nothing here is intended to be groundbreaking research, it’s just stuff from the trenches that might be useful to someone else.

Most of it will be short. A detection that took a few tries to get right, a log source that doesn’t behave the way the docs say, something I had to look up twice. If a topic turns into a longer write-up, even better.

It also forces me to actually write, which I’ve never been great at. So bear with me.

About Me

I’m a senior security engineer working in cloud incident response. Most of my day-to-day revolves around DFIR, detection & response, detection engineering, and threat hunting.

Before this I was a security engineer building out Azure and AWS infrastructure, a sysadmin keeping a mix of cloud workloads and SaaS running, a help desk tech doing a bit of everything, and a pizza delivery driver making fresh dough daily.

Thanks for stopping by, cheers!