A Sigma-to-Wazuh compiler, an approval-gated IT and SecOps environment, an MCP traffic proxy, a deception fabric, and a SAML diagnosis pipeline. Each one names, on its own page, the thing it cannot do.
A from-scratch Sigma-to-Wazuh compiler with validation gates, stable rule identity, and API deployment behind a dry run.
58 Sigma → 216 Wazuh rules
119 ATT&CK techniques, 14 tactics
87 automated tests
57 of 58 rules target Windows process creation
An approval-gated environment where identity, endpoint state, ticketing, alerts, approvals, and audit evidence run as one executable chain. Every privileged action passes a recorded policy decision.
2,092-case policy parity
90 of 108 privileged attempts denied
1,631 audit records, chain valid
Synthetic environment, not a production platform
Captures MCP tool-call traffic and turns it into evidence a human reviewer can act on. Ten bounded detections, an inventory of every trust boundary crossed, and a written list of what the rules cannot see.
10 rules, 5 abuse techniques
4,727-record benign corpus
12 documented evasion classes
3 of 12 evasion classes are structurally undetectable
An Authentik SSO perimeter wired to Canarytokens and a Python enrichment service, built to study high-signal identity tripwires.
Authentik + Canarytokens
Flask webhook processor
AbuseIPDB enrichment, ARM64 lab
Proof of concept, not a production identity control
A SAML sign-in failure diagnosis pipeline where a deterministic verifier establishes the facts and a grounding gate rejects any model claim the facts do not support.
55 SAML cases, 94.5% disposition accuracy
6 of 6 reachable injection payloads resisted
0 secrets across 280 recorded prompts
Keycloak only, and the AI path still trails the deterministic path
Traced a HiddenAds infection on a family device with ADB and package timelines, then reversed the APK in an isolated Kali lab. Identifiers and the sample stay redacted.
ADB + package timeline
APKTool, JADX, VirusTotal
Published write-up, Sep 2025
All six were built the same way. The logic is readable, it runs against recorded evidence, and the part it cannot resolve is written down on the page.