Technical notes & releases.
Detection engineering writeups, architecture decisions, and what shipped — written by the person building it, not a marketing team.
Kafka is optional: designing for graceful degradation
Not every self-hosted deployment wants to run a Kafka cluster. Here's how XCloak treats it as an enhancement rather than a hard dependency, and where that tradeoff actually lives in the code.
Why every destructive SOAR action needs a human click
Playbooks can isolate a host or kill a process automatically — except they can't, not without someone approving it first. Here's the design behind that gate, and why it's not configurable.
Multi-tenancy and row-level security: what an internal audit found
A defense-in-depth layer we built but hadn't fully wired up — how we found it, why it mattered, and what changed.
Why we built our own Sigma engine
Sigma is a spec, not a library. Here's what we implemented, what we deliberately left out, and why field-level matching plus logsource pre-filtering was the right subset to start with.
How a log line becomes an alert
The full pipeline from agent telemetry to a dashboard notification — normalization, Sigma evaluation, correlation, and real-time delivery.
Enterprise Firewall + Deep Packet Inspection
How the firewall went from a basic rule list to an enterprise policy engine — and how four new DPI detectors add multi-layer L7 visibility: DGA scoring, TLS anomalies, HTTP inspection, and protocol tunneling.
XCloak v0.2.0: Enterprise Security Hardening
v0.2.0 is the most significant XCloak release to date — httpOnly cookie auth, atomic rate limiting, PostgreSQL RLS now load-bearing, and Kafka wired end-to-end.
Building Enterprise Android MDM Without Google EMM
A Flutter foreground service that collects security telemetry and accepts management commands without requiring EMM enrollment or Device Owner mode.
How XCloak Maps Linux /proc/net to Process Names
What process owns this network connection? On Linux the answer lives in /proc — the inode bridge from socket table to PID to process name.
Closing the TOCTOU Gap in Redis Rate Limiting
Rate limiters look simple but contain a subtle concurrency trap. Here's how we found it and closed it with an atomic Lua script.
Subscribe via RSS to get new posts as they publish.