Uses

DETECTION & SIEM

Where most of the day goes.

Wazuh 4.14

The platform everything I build plugs into. Open source, hackable rule engine, and the decoder chain is comprehensible if you are willing to read it.

Sigma

Every OT Sentinel rule ships as Sigma alongside the Wazuh XML. Portable detection logic outlives whichever SIEM you are currently married to.

wazuh-logtest

The tightest feedback loop in detection engineering. Paste a log line, see exactly which decoder and rule claim it. Half my test harness is a wrapper around this.

MITRE ATT&CK + ATT&CK for ICS

A shared vocabulary rather than a compliance checkbox. A rule without a technique mapping is a rule nobody else can reason about.

Sysmon · auditd

The telemetry underneath. A detection pack is only as good as the events its endpoints are actually configured to emit, which is the step everyone skips.

OT / ICS LAB

How you test an industrial detection without an industrial plant.

OpenPLC

A real soft-PLC speaking real Modbus. The 8 Modbus rules in OT Sentinel were validated against this, which is why I will claim hardware validation for those and not the others.

GNS3

Network emulation for the digital twin. Lets you build a plausible plant topology and then attack it without anyone losing a shift.

pymodbus

Test scripts that generate the actual attack traffic: unauthorised writes, coil manipulation, function code scans.

Unreal Engine 5

Not a joke. The OT digital twin annotation engine runs here, doing mesh segmentation that produces 52-component assemblies with IEC/ISA taxonomy manifests.

INFRASTRUCTURE

Air-gap capable, because some customers require it.

RKE2 Kubernetes

Three-hypervisor cluster on libvirt/KVM. Chosen over vanilla k8s specifically because it behaves in a disconnected install.

Terraform + Ansible

Provision then configure. The cluster can be rebuilt from nothing, which is the only real test of whether it was ever provisioned properly.

CloudNativePG

Postgres as an operator. Failover and backups you did not have to write.

Strimzi Kafka

Event backbone. Same argument as above: operators over bespoke stateful sets.

MinIO · Longhorn · cert-manager

Object storage, block storage, and the thing that stops TLS certificates from becoming a calendar reminder.

Prometheus

sb-siem-mcp exposes 7 series. If an agent starts hammering a tool, that should show up on a graph and not in a support ticket.

BUILDING

Python

Most of what I ship. FastMCP, aiohttp, pytest-asyncio.

FastMCP

The MCP server framework behind sb-siem-mcp. Typed tool contracts with very little ceremony.

TypeScript

This site, and anything with a browser in front of it.

Docker

Multi-stage production builds, non-root containers. The demo compose stack is a convenience, not a deployment.

GitHub Actions

CI test matrix, release, and a security scan job running Dependabot, pip-audit and CodeQL weekly and on every push.

THIS SITE

Deliberately boring, so it still works in 2035.

Next.js (static export)

Builds to plain HTML, CSS and JS in ./out. Hostable anywhere, forever, framework or no framework.

Plain CSS

One file, one set of variables, no framework. The whole design system fits in a few hundred lines and I can read all of it.

Markdown + gray-matter

Content as files. Portable to whatever comes next in an afternoon.

Vercel

Push to main, it rebuilds. Custom domain, automatic TLS, nothing to maintain. The output is a static export, so moving hosts is a matter of pointing something else at ./out.