Practical guidance for detection engineering decisions and defensible security work.
67 resources
Specify telemetry for AI tool calls and Model Context Protocol interactions that preserves caller, authority, operation, target, protected arguments, policy, result, and trace relationships.
Represent the initiating user, application, agent instance, model operation, delegated credential, tool, and target resource as distinct identities so agent actions remain attributable and b...
Use metadata from encrypted traffic to assess communication behavior while keeping payload content, application identity, user intent, and attribution outside claims the evidence cannot supp...
Use artifact provenance and attestations as signed statements about build relationships, then detect mismatches without treating presence, signature validity, or high assurance as proof that...
Detect abuse in source, build, package, secret, and deployment systems by following identities and artifacts across trust boundaries rather than treating pipeline success as legitimacy.
Interpret Kubernetes audit events as API-server observations whose stage, level, identity, resource, authorization, and policy limits determine what a detection can honestly claim.
Reason from SaaS audit records without assuming that a vendor’s event catalog, retention tier, actor field, or successful response provides complete security visibility.
Design cloud detections around control-plane requests, identities, resources, policy decisions, and asynchronous effects while respecting provider-specific logging boundaries.
Detect identity abuse by separating grants, tokens, sessions, clients, and resource access, then reasoning about issuance, binding, rotation, revocation, and replay evidence.
Apply purpose limitation, necessity, minimization, access control, retention, and oversight to security monitoring while preserving the evidence needed for a defined defensive decision.
