$ ls ./writing
Writing
Notes on forensics, incident response and the tooling around them. Older posts are on Medium; nothing has been migrated here yet.
Drafts
DFIR
Automating DFIR triage with KAPE and timeline analysis
Collection through artifact parsing to a single timeline — what it catches and what it still misses.
DFIR
A Volatility auto-parser for Linux memory images
Kernel detection, ISF symbol fetching, plugin orchestration.
Intel · Detection
From intel report to deployed detection
IoC extraction, enrichment, and pushing detections out across tenants.