Knowledge base / Tools
Purpose-first guides to defensive security tools: what each tool can answer, what evidence it needs, and where analysts commonly overreach.
A practical cURL guide for system administrators. Test APIs, DNS, HTTPS, certificates, authentication, proxies, redirects, webhooks, downloads, performance and network connectivity directly from the command line.
Learn what n8n is, how IT administrators and businesses can use it, practical automation examples, self-hosting basics, security risks, AI integration and real-world workflow ideas.
A blunt, evidence-led comparison of MikroTik and Cisco across price, licensing, security, performance, support and operational effort, with practical RouterOS and IOS XE audit commands.
Build, convert and tune Sigma rules for SQL-injection strings, application validation failures and suspicious processes spawned by web servers.
Check your own public IP, on-premises mail server and WordPress site with safe commands, evidence-led interpretation and practical remediation.
Use packet capture to explain endpoints, protocols, timing, and failures while respecting encryption and data sensitivity.
Use Nmap for asset and service discovery without turning an inventory task into an uncontrolled production test.
Understand agent, server, indexer, and dashboard responsibilities before scaling collection or importing rules.
Write behaviour-focused rules with complete metadata, then validate field mapping and generated queries on the real target platform.
Build rules from stable combinations of strings and structure, with a corpus that measures both misses and false positives.
Use artefacts and VQL collections to answer scoped forensic questions while preserving provenance and limiting unnecessary data.
Use SQL-like queries for inventory and state while respecting table cost, platform differences, scheduling, and result interpretation.
Configure focused Windows event generation, forward it reliably, and tie each event class to an investigation or detection need.
Use deterministic recipes for decoding, hashing, extraction, and comparison while avoiding accidental data disclosure.
Scan images, filesystems, configuration, and dependencies with scope and policy, then connect findings to deployed exposure and an owner.