Ci-Cd

loading · loading ·

An Honest Coverage Map (and a Console That Never Makes Up a Number)

7 September 2026·1294 words·7 mins· loading · loading

Mitre-Attack Attack-Navigator Qradar Detection-as-Code Coverage Ibm-Carbon React Typescript Ci-Cd Sigma Blue-Team Soc Data-Visualization

Folding conversion, deployment and validation into one ATT&CK Navigator layer with two status rules that keep it from lying, plus a Carbon console over the same files.

Deploying Detections Without Making a Mess

1 September 2026·1048 words·5 mins· loading · loading

Qradar Detection-as-Code Deployment Idempotence Ariel Saved-Searches Sigma Aql Siem Ci-Cd Blue-Team Automation Uuid

Idempotent deployment keyed on the Sigma UUID, so a renamed rule updates in place instead of spawning a duplicate. And a –dry-run that never lies about being deployed.

What The Sigma: Translating Detections Is Solved, Trusting Them Isn't

20 August 2026·1041 words·5 mins· loading · loading

Detection-as-Code Sigma Qradar Aql Ibm Siem Blue-Team Soc Mitre-Attack Ci-Cd Pysigma Threat-Detection Dfir

Why I built a detection-as-code pipeline around IBM’s own Sigma-to-QRadar backend, and why the interesting part isn’t the translation.

↑