Tagged: #detection-engineering

I set out to catch a credential-dumping attack in my homelab SIEM. What I actually caught was my SIEM missing it — and fixing that blind spot turned out to be the real work.