418 words
A log file is input too
Most teams think of agent input as the prompt box. A person types something, the agent answers. That is the input you can see. Point the same agent at a log file and the picture changes. The agent reads every…
Install
Latest in DevOps, CI/CD & Platform Engineering
297 words
Wazuh snort decoder cuts the last octet off srcip and dstip (4.14.x)
If a snort alert has no source port, Wazuh 4.14.x stores srcip without its last octet: 10.4.12.26 becomes 10.4.12. When the destination has a port, the port stays glued to dstip. Anything keyed on those fields, such as active response, CDB lists…
766 words
Claude Code Ignoring CLAUDE.md? See What's in Its Context
Diagnosing hidden file loading failures When Claude Code ignores a rule, the usual move is to reword it. Start with the verb, use backticks for literals, bold segments that you want to maintain elevated focus over the surrounding prose, and…
172 words
One host hit port 445 on many others at 2 a.m.: the pre-lateral knock
The scenario is fictional (10.0.0.0/8). The fan-out aggregation was tested on a synthetic firewall log. A burglar tries doors one by one. On a network that is one host connecting to many internal hosts on the same port, in a short…
211 words
C2 beacons give themselves away by the clock
The scenario is fictional (RFC 5737 IPs). Aggregations were tested on synthetic data. Humans don't connect to the same host exactly every 60 seconds. Malware coded to "phone home every minute" does. That regularity is a footprint. 02:24 the payload starts on web03; from…
673 words
Why can't git checkout undo what an AI coding agent changed?
When an AI agent edits files in your project and breaks something, the reflex is git checkout --. or git stash. Both answer a different question than the one you have. Git can take you back to the last commit. What…
140 words
Windows persistence collapses to a few places: audit first, then diff
The scenario is fictional. Commands and event IDs come from the book and aren't tested here; use a test environment first. Detection only. On Linux we audited keys and cron. Windows follows the same logic. Remember one line from part…
710 words
What tells you a Wazuh rule has gone quiet?
An MSSP detection lead described a gap to us this week. Use cases are validated before go-live and re-tested by a BAS tool every six months. In between, a log source changes. A parser update renames a field, or someone…
599 words
I don't have tests on my biggest project. Here's my plan to fix that
Writing tests is advice I give and haven't followed everywhere. CardBridge has no automated test suite. The case study says so, and I've said it twice already in this series. So here's the plan, publicly, so I'm accountable. It's also…
429 words
Fewer tools, smaller blast radius: trimming an MCP server pays off twice
Most MCP servers get built by adding. Someone needs a lookup, so a tool goes in. Someone needs an update, so another goes in. Nobody comes back to remove anything. If a workflow uses MCP, that pile of tools has…
DevOps, CI/CD & Platform Engineering
Pipelines, containers, Kubernetes, IaC/GitOps, observability, and team “golden paths.”
- 5 Subtopics
- 10 Tracked terms
- Last 30 days Feed window
Inside DevOps, CI/CD & Platform Engineering
Containers & Kubernetes Docker, images, Helm, autoscaling, and cost controls.
IaC & GitOps Terraform/Pulumi, Ansible, drift detection, and declarative delivery.
CI/CD Pipelines Build/test/deploy across GitHub Actions, GitLab, Jenkins, and progressive delivery.
Observability & Incidents Logs, metrics, traces (OTel), on-call, postmortems, and reliability engineering.
Edge & Serverless Functions, edge runtimes, cold starts, and multi-region strategy.
What this topic collects on
An article joins this feed when it matches these terms. Each one is also a search of its own.