Adding a short summary mode to authlog-watch
Keep event totals visible while leaving user, source and finding details to the full report.
Infrastructure
2 min
Articles
Notes from my security tools, open-source fixes and study. Some cover a small code change; others explain a topic I am learning.
30 articles in 10 monthly groups. A group collects the work or study topic of that month; each article keeps its own publication date.
Subscribe via RSS ↗No matching articles. Try a broader term or clear the filters.
October 2026
Counting a flagged web request once
A request can match two rules. The source summary should still count one request.
Engineering
2 min
Hiding noisy IDs in a JSONL report
How jsonl-lens hides repeated value lists while keeping the field warning and schema counts.
Engineering
2 min
Keeping IOC extraction offline with --no-enrich
The CLI flag, early return and configured-key regression behind Sentinel’s offline extraction mode.
Blue Team
2 min
Handling *:PORT in my socket parser
The wildcard case, the C helper and a two-row regression fixture in socket-state-triage.
Networking
2 min
Why I contribute to open source
A few fixes I sent to cfn-lint, pyinfra and Prowler, and why I return them to the projects.
Open Source
2 min
Keeping study time and recall scores separate
A StudyPulse note about timer records, grading responses and reward calculations.
Engineering
2 min
September 2026
Adding INI files to Graphtage's semantic diff
Graphtage #120 parses INI with the standard library, reuses the existing tree model, and tests the formatter with randomized round trips.
Engineering
2 min
Where I added the lifecycle policy check in cfn-lint
A Fn::Select case needed a policy-level check while the shared resolver stayed unchanged.
Cloud Security
2 min
Supporting SSH host certificates in pyinfra
How I handled CA entries in known_hosts while keeping strict host checking enabled.
Infrastructure
2 min
August 2026
When a failed API call turned into a PASS in Prowler
Prowler #12217: an ECS task definition that could not be described looked the same as one with nothing wrong in it.
Cloud Security
2 min
Reading the error fields in a CloudTrail finding
An API name does not show the whole result. A note on failed requests, target identities and follow-up checks.
Cloud Security
2 min
Missing fields, null values and type changes in JSONL
How jsonl-lens counts these cases separately, with three small example records.
Engineering
2 min
July 2026
Teaching Trivy where a Jenkins plugin declares its license
Trivy #10939 adds the Plugin-License-Name manifest attribute as a JAR license source, between the embedded pom.xml and packed LICENSE files.
Open Source
2 min
Checking register projection names in ansible-lint
ansible-lint #5110: a newer register syntax made var-naming check a whole mapping as if it were one variable name.
Infrastructure
2 min
Adding clickable PyPI Inspector links to GuardDog output
GuardDog #797 links each finding to the exact file and line on PyPI Inspector. The link is built from package data, so it is treated as untrusted output.
Open Source
2 min
Adding a hostPath check to Prowler
The Kubernetes volume data, Pod-level result and tests needed for Prowler #11837.
Kubernetes
2 min
How I use Astro Content Collections for my portfolio
How I keep cards and pages in sync, publish Markdown and search the article archive without a backend.
Engineering
2 min
June 2026
Checking IAM permissions boundary removal in CloudTrail
The event, the affected identity and the tests behind one rule in cloudtrail-quickscan.
Cloud Security
2 min
My first pass at reading CloudTrail logs
I started with fake logs because small data helps me understand the shape before I try bigger tools.
Cloud Security
2 min
May 2026
What I learned from a small open source PR
A small PR can show real engineering skill when it is focused and easy for maintainers to review.
Open Source
2 min
Building a small IOC extraction tool
Parsing IPs, URLs and hashes is a small project, but it feels close to real blue-team work.
Blue Team
2 min
April 2026
What a listening address tells me about exposure
Local bind scope is one part of the check. Firewall rules, routes and proxies still matter.
Networking
2 min
Why networking basics still matter
Security feels much clearer when I understand packets, ports, DNS, routes and Linux tools.
Networking
1 min
March 2026
Linking a project page to its evidence
What I want a reader to be able to check from a case study: inputs, tests, revisions and limits.
Engineering
2 min
Treating my portfolio like a real system
A personal site can be more than a resume. It can show how I organize work and improve over time.
Engineering
1 min
February 2026
Checking where VPN traffic is routed
A connected status is only a starting point. Check the destination route and DNS result separately.
Infrastructure
2 min
Small notes from learning Linux and VPN basics
I learned that secure systems start with small habits: reading logs, checking services, and understanding routes.
Infrastructure
1 min
January 2026
Making a small security lab repeatable
A small input and a clear question make it easier to check what a rule actually does.
Learning
2 min
Finding a study rhythm for cyber security
Cyber security has too many topics, so I try to connect study with small projects and notes.
Learning
1 min