https://blog.xcloak.tech/ Technical notes, releases, and detection engineering from XCloak. en-us https://blog.xcloak.tech/posts/kafka-optional-by-design.html https://blog.xcloak.tech/posts/kafka-optional-by-design.html Not every self-hosted deployment wants to run a Kafka cluster. Here's how XCloak treats it as an enhancement rather than a hard dependency, and where that tradeoff actually lives in the code. Fri, 07 Aug 2026 00:00:00 GMT https://blog.xcloak.tech/posts/soar-human-approval.html https://blog.xcloak.tech/posts/soar-human-approval.html Playbooks can isolate a host or kill a process automatically — except they can't, not without someone approving it first. Here's the design behind that gate, and why it's not configurable. Fri, 31 Jul 2026 00:00:00 GMT https://blog.xcloak.tech/posts/rls-multitenancy-audit.html https://blog.xcloak.tech/posts/rls-multitenancy-audit.html A defense-in-depth layer we built but hadn't fully wired up — how we found it, why it mattered, and what changed. Fri, 24 Jul 2026 00:00:00 GMT https://blog.xcloak.tech/posts/sigma-engine-internals.html https://blog.xcloak.tech/posts/sigma-engine-internals.html Sigma is a spec, not a library. Here's what we implemented, what we deliberately left out, and why field-level matching plus logsource pre-filtering was the right subset to start with. Fri, 17 Jul 2026 00:00:00 GMT https://blog.xcloak.tech/posts/log-line-to-alert.html https://blog.xcloak.tech/posts/log-line-to-alert.html The full pipeline from agent telemetry to a dashboard notification — normalization, Sigma evaluation, correlation, and real-time delivery. Fri, 10 Jul 2026 00:00:00 GMT https://blog.xcloak.tech/posts/enterprise-firewall-and-dpi.html https://blog.xcloak.tech/posts/enterprise-firewall-and-dpi.html How the firewall went from a basic rule list to an enterprise policy engine — and how four new DPI detectors add multi-layer L7 visibility: DGA scoring, TLS anomalies, HTTP inspection, and protocol tunneling. Fri, 11 Jul 2026 00:00:00 GMT https://blog.xcloak.tech/posts/xcloak-v0-2-0.html https://blog.xcloak.tech/posts/xcloak-v0-2-0.html v0.2.0 is the most significant XCloak release to date — httpOnly cookie auth, atomic rate limiting, PostgreSQL RLS now load-bearing, and Kafka wired end-to-end. Tue, 07 Jul 2026 00:00:00 GMT https://blog.xcloak.tech/posts/android-mdm-without-emm.html https://blog.xcloak.tech/posts/android-mdm-without-emm.html A Flutter foreground service that collects security telemetry and accepts management commands without requiring EMM enrollment or Device Owner mode. Mon, 06 Jul 2026 00:00:00 GMT https://blog.xcloak.tech/posts/proc-net-process-names.html https://blog.xcloak.tech/posts/proc-net-process-names.html What process owns this network connection? On Linux the answer lives in /proc — the inode bridge from socket table to PID to process name. Sun, 05 Jul 2026 00:00:00 GMT https://blog.xcloak.tech/posts/redis-rate-limiter-toctou.html https://blog.xcloak.tech/posts/redis-rate-limiter-toctou.html Rate limiters look simple but contain a subtle concurrency trap. Here's how we found it and closed it with an atomic Lua script. Fri, 03 Jul 2026 00:00:00 GMT