SECURITY ENGINEERING · SYSTEMS RESEARCHNOTES FROM THE INSTRUMENTATION LAYER

Lead research log

ARTICLE · RESEARCH

Using eBPF as Behavioural Ground Truth for Threat Research and Detection Engineering

A container-scoped eBPF sensor for observing malware behaviour, probing telemetry coverage, and automating detection validation.

18 JUL 2026INTERMEDIATEEBPF · BCC · PYTHON

READ THE INVESTIGATION

SIGNAL PATHSOURCE→COLLECT→NORMALIZE→DETECT→ANALYZE

Indexed collection

Recent research

Investigations, implementation notes and observations from detection engineering work.

ARTICLE · DETECTION ENGINEERING

Detection Quality Indicators: A Structured Approach to Better Detections

A practical framework for evaluating detection intent, resilience, operational cost, and production outcomes.

ARTICLE · DETECTION ENGINEERING

Detection-as-Code: Building Systems, Not Just Rules

A practical approach to treating detections as software: explicit contracts, testable logic, controlled delivery, and feedback from production.

VIEW THE COMPLETE RESEARCH INDEX →