Endpoint telemetry
ETW, Sysmon, process activity, and the Windows signals behind EDR products.
Detection engineering · Windows internals · Open-source labs
Build the telemetry.
Understand the detection.
Hands-on notes by Daniel Jeczen about EDR internals, SIEM pipelines, and the engineering between an endpoint event and an actionable signal.
Detection systems
Small, inspectable pipelines for collecting, shaping, storing, and querying security events.
Build notes
Code-first walkthroughs, operational trade-offs, and honest next steps for each experiment.
From the notebook
Latest writing
10 min read
Detection Is a Data-Modeling Problem
Detection quality depends on event semantics, schema evolution, idempotency, and honest health signals before it depends on clever rules.
11 min read
What You Cannot See
Every endpoint sensor has structural blind spots. The important skill is identifying, testing, and documenting them.
10 min read
Cutting the Network from Inside
Network isolation is a distributed-systems problem: preserve control, apply policy atomically, and design a safe path back.