DEV Community

#detectionengineering

Posts

đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.
Wazuh snort decoder cuts the last octet off srcip and dstip (4.14.x)

Wazuh snort decoder cuts the last octet off srcip and dstip (4.14.x)

Comments
3 min read
Wazuh custom rule never fires: shadowed by a sibling rule (and analysisd -t exits 0)

Wazuh custom rule never fires: shadowed by a sibling rule (and analysisd -t exits 0)

Comments
4 min read
I Taught My AI Agent to Write YARA-L Rules That Actually Compile

I Taught My AI Agent to Write YARA-L Rules That Actually Compile

Comments
5 min read
The First Sign Was Silence: Detecting Edge Devices That Stop Talking

The First Sign Was Silence: Detecting Edge Devices That Stop Talking

Comments
3 min read
Detecting PAN-OS CVE-2026-0321 with the telemetry you already collect

Detecting PAN-OS CVE-2026-0321 with the telemetry you already collect

Comments
3 min read
CWE-35 or CWE-22? The Classification Split Around CVE-2026-85706

CWE-35 or CWE-22? The Classification Split Around CVE-2026-85706

Comments
3 min read
Detection content as code: reviewing a change the way you review software

Detection content as code: reviewing a change the way you review software

Comments
2 min read
Detection Engineering Starts With the Logs You Decided to Keep

Detection Engineering Starts With the Logs You Decided to Keep

Comments
2 min read
Detection engineering for CVE-2026-100382: hunting the External Data web shell

Detection engineering for CVE-2026-100382: hunting the External Data web shell

Comments
3 min read
Three reasons a custom Wazuh rule stays silent after a clean config check, measured on 4.14.7

Three reasons a custom Wazuh rule stays silent after a clean config check, measured on 4.14.7

Comments
5 min read
Exploitation Conditions in CVE-2026-75682: What a Low-Privileged Account Buys an Attacker

Exploitation Conditions in CVE-2026-75682: What a Low-Privileged Account Buys an Attacker

Comments 1
3 min read
Wazuh custom rule never fires, and analysisd -t still exits 0: the file name decides

Wazuh custom rule never fires, and analysisd -t still exits 0: the file name decides

1
Comments
3 min read
đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.