Research topic
Detection & response
A detection is only as complete as its evidence path.
26 publications
Practical analysis of cloud telemetry, detection coverage, investigation quality, and recovery readiness.
View every topicFrom the desk
26 publicationsCloud logs that never reach the SIEM
A dashboard can be healthy while the evidence behind it is incomplete. Coverage needs to be tested from event creation to searchable record.
Five Kubernetes events your cloud trail will not explain
Cloud control-plane logs tell you who changed the cluster. They do not fully explain what happened inside it.