Everything we sell on,
we measured first.

<hostname> matches in logtest, never fires for agent events. For agent events Wazuh compares <hostname> with the agent name, while the alert still shows the syslog host.

Wazuh rule dropped at load (7617/7619). A child rule in a file that sorts before its parent's file is ignored, and wazuh-analysisd -t still exits 0. Measured on five file names.

Passes wazuh-logtest, never fires in production. Five measured causes, from restarts that reset frequency counters to <hostname> meaning the agent name for agent events.

Shadowed by a sibling rule. Children of one parent go by level. Which fix to pick, and which one silently turns off a stock brute-force alert.

mapper_parsing_exception: in alerts.json, not in the dashboard. A field that is an object in some events and a string in others. Stock template, two measured fixes.

Cannot read 'srcip' from data. What active response reads, in what order, and why an invalid IP does not fall back. Read from the 4.14.7 source.

Detection Evidence Map — 84 ATT&CK techniques. One evidence record per technique. 3 checked and observed, 22 not tested, 59 not observable with this sensor set — and zero rows back-filled.

Position paper, IETF post-quantum authentication workshop. One handshake against 40 front doors. 31 negotiated hybrid post-quantum key exchange; none presented a post-quantum signature.

Crypto Reality Index Vol.1. We offered hybrid post-quantum key exchange to 45 public endpoints. 20 declined it. Includes a published correction.

Detection Reality Index Vol.3 — the between-audit gap. Zero of 51,937 Emerging Threats rules fired on an ordinary port scan.

Detection Reality Index Vol.2 — IBM QRadar. The same technique set replayed against a second SIEM, with measured time to alert.

Detection Reality Index Vol.1. 24 ATT&CK techniques replayed against a default SIEM install. Three raised an alert. Not three percent — three techniques.