Tagged: #siem

I set out to catch a credential-dumping attack in my homelab SIEM. What I actually caught was my SIEM missing it — and fixing that blind spot turned out to be the real work.