Tagged: #blue-team

I set out to catch a credential-dumping attack in my homelab SIEM. What I actually caught was my SIEM missing it — and fixing that blind spot turned out to be the real work.

I brute-forced my own homelab server to see what was behind an open SSH port — and found out my Wazuh setup had already caught me in the act.