// FIELD NOTES
Insights from the SOC floor.
Working notes from detection engineers, threat hunters, and SecOps leaders. No vendor talking points, no recycled threat reports — just what we've learned standing watch.
Detection Engineering
Detection-as-code: shipping content like software
Apr 20268 min read · 01
MITRE ATT&CK
Mapping coverage without lying to yourself
Mar 20266 min read · 02
SOAR
Why most playbooks fail at 3 AM (and how to fix yours)
Mar 20269 min read · 03
Insider Threat
Behavioral baselines for cleared user populations
Feb 20267 min read · 04
Compliance
Reading NIST 800-53 like an engineer, not a lawyer
Feb 202611 min read · 05
Splunk
Tuning out the noise: a structured FP-reduction model
Jan 202610 min read · 06
// READY WHEN YOU ARE
Harden your attack surface.
Schedule a 30-minute scoping call. We'll outline a clear path to better detection, faster response, and stronger compliance posture.