A practitioner's blog on using LLMs and coding agents in detection engineering, covering query writing, a packaged rule-development workflow, and metrics for maintaining a detection catalog. Posts explain the reasoning behind each design choice and the failures that shaped it.
Website: https://tresscross.blog/
Cisco Talos publishes threat research, vulnerability disclosures and analysis of attacker campaigns, with detection and coverage guidance for Cisco customers. Recent posts cover critical PHP flaws, abuse of legitimate platforms for phishing delivery, and the surge in AI-discovered vulnerabilities.
A technical newsletter from an IT professor-style author that works through Microsoft security engineering problems with concrete KQL, showing why common detections and sharing settings fail in practice. Readers get practical guidance on Sentinel cost reduction, flawed analytic rules, and the security risks of anonymous sharing links.
A cybersecurity newsletter that reconstructs real ransomware negotiation chat transcripts and analyses the tactics, pricing and psychology on both sides. Each issue walks through a case study, drawing out what the exchanges reveal about attacker and victim behaviour.
One short email a week with hand-picked newsletters from the index. Free, no spam, unsubscribe anytime.
