Everything we sell on,
we measured first.

Detection Reality Index Vol.1. 24 ATT&CK techniques replayed against a default SIEM install. Three raised an alert. Not three percent — three techniques.

Detection Reality Index Vol.2 — IBM QRadar. The same technique set replayed against a second SIEM, with measured time to alert.

Detection Reality Index Vol.3 — the between-audit gap. Zero of 51,937 Emerging Threats rules fired on an ordinary port scan.

Detection Evidence Map — 84 ATT&CK techniques. One evidence record per technique. 3 checked and observed, 22 not tested, 59 not observable with this sensor set — and zero rows back-filled.

Position paper, IETF post-quantum authentication workshop. One handshake against 40 front doors. 31 negotiated hybrid post-quantum key exchange; none presented a post-quantum signature, which is expected, since no public CA can issue one yet.

Crypto Reality Index Vol.1. We offered hybrid post-quantum key exchange to 45 public endpoints. 20 declined it. Includes a published correction.

PHP2Shell: stock Wazuh does not alert on PHP-FPM crashes or out-of-memory floods. 4.14.9, one decoder and eight tested rules.

snort decoder cuts the last octet off srcip and dstip. 4.14.x, with a local decoder correct on seven samples.

usermod to sudo and MySQL access denied raise no alert. 4.14.9 stock ruleset gap, with a tested local decoder and rules.

<hostname> matches in logtest, never fires for agent events. For agent events Wazuh compares <hostname> with the agent name, while the alert still shows the syslog host.

Wazuh rule dropped at load (7617/7619). A child rule in a file that sorts before its parent's file is ignored, and wazuh-analysisd -t still exits 0. Measured on five file names.

Passes wazuh-logtest, never fires in production. Five measured causes, from restarts that reset frequency counters to <hostname> meaning the agent name for agent events.

Shadowed by a sibling rule. Children of one parent go by level. Which fix to pick, and which one silently turns off a stock brute-force alert.

mapper_parsing_exception: in alerts.json, not in the dashboard. A field that is an object in some events and a string in others. Stock template, two measured fixes.

Cannot read 'srcip' from data. What active response reads, in what order, and why an invalid IP does not fall back. Read from the 4.14.7 source.