Author: stebutty
October 27, 2026
/ Case Study, Insights
APT44: From Network Compromise to Industrial Disruption
An examination of Sandworm, Industroyer2 and the challenges of detecting threats against industrial control systems. Introduction When we talk about…
October 28, 2025
/ Masterclass
🔧 Detection-as-Code: What It Really Means
Masterclass Series – Part 2 🧭 TL;DR: It’s Not Just “Put Your Rules in Git” “Detection-as-Code” sounds like a trendy…
October 23, 2025
/ Insights
The Cost of Crying Wolf: Why False Positives Are Killing Your SOC
Introduction It’s not the alerts you miss that break a SOC — it’s the thousands you never should have seen…
October 16, 2025
/ Case Study
When CIM Mapping Goes Sideways: Lessons from a Broken Detection
🔎 Introduction Everything looked good on paper:✅ The detection rule was written.✅ The sourcetype was CIM-mapped.✅ The data model was…
October 14, 2025
/ Masterclass
🧠 Macro-Driven Rule Logic – Splunk Masterclass 1/5
👋 Welcome to the LogSmith Splunk Masterclass This series is for detection engineers, Splunk admins, and SOC architects who want…
October 7, 2025
/ Insights
5 Signs Your SIEM Is Too Noisy
And what to do about it before your SOC burns out Your SIEM might look functional. It might be alerting….