I’m Daniel Jeczen, a cybersecurity practitioner interested in how endpoint and detection systems work beneath the dashboard.

This site is my public engineering notebook. I use small, reproducible projects to explore Windows telemetry, EDR internals, security data pipelines, and the trade-offs involved in turning raw events into useful detections.

What you’ll find here

• EDR experiments built close to Windows APIs such as ETW
• SIEM pipelines assembled from open-source components
• implementation notes, diagrams, queries, and lessons learned
• practical security engineering without vendor-heavy abstractions

The articles are written for defenders, students, and engineers who prefer to learn by building. Examples are educational and should be tested in an isolated lab before being used elsewhere.

Connect

You can find my code on GitHub or connect with me on LinkedIn.