Sigma Rules
Vendor-agnostic, YAML-based detection language for SIEMs — write the rule once, translate to Splunk, Elastic, Sentinel, or any supported backend.
Atlas
A knowledge graph of cybersecurity concepts. Atomic notes — definitions, prereqs, retrieval prompts, references — that interconnect across the discipline. The methodology I use to learn the field, in public.
Endpoint Security (1)
Foundations (3)
Defense in Depth
A security strategy that stacks independent layers of controls so that when one fails, as it eventually will, another still stops or reveals the attack.
Least Privilege
The design principle of giving every user, process, service or agent only the access its task requires, and only for as long as it requires it.
MITRE ATT&CK
Globally-accessible knowledge base of adversary tactics, techniques, and procedures (TTPs) observed in real-world attacks, maintained by MITRE.