Detection
4 posts · Detection
Falco rules that catch real attacks (and skip the noise)Default rulesets page you for everything. Tune Falco to the syscalls that matter and route the rest to a dashboard.Nov 25, 2025 · 4 minAdvancedfalcoebpfPrometheus alerting rules that don't cry wolfWrite alerts on symptoms with for-durations and good labels so on-call gets pages that actually mean something.Sep 30, 2025 · 4 minIntermediateprometheusalertingParse auditd logs with Python before they hit your SIEMRaw audit records are unreadable and expensive to index. Normalize them with 80 lines of Python and cut ingest cost.Jul 15, 2025 · 4 minBeginnerpythonauditdLog aggregation with Loki and structured loggingShip JSON logs, label them well, and query with LogQL — centralized logs without a heavyweight indexing bill.Apr 22, 2025 · 4 minIntermediatelokilogging