A blue-team field notebook
Investigate.
Understand.
Detect.
Welcome to the guarded kernel. A place for my notes on incident analysis, detection principles, and APT research — and what I learn along the way.
About the authorLatest articles
No articles published yet.
This notebook starts here. Future entries will cover incidents, detection ideas, and the people and techniques behind attacks.
What this blog covers
- Incident analysis
- Following the evidence, reconstructing events, and learning from the investigation.
- Detection principles
- Understanding behaviour, choosing useful telemetry, and turning ideas into detections.
- APT research
- Studying threat groups, their techniques, and what defenders can look for.