About the work

A closer look.

If you got here after typing "failed login", "log review", "suspicious login", "brute force", "weird login", or "too many alerts": you are in the right place. That is exactly the kind of noise I rewrite. Send me one detection rule, Sigma rule, or raw SOC alert. You get back a short written critique and a rewritten version. What I check: what the alert actually claims versus what it proves; the false-positive population it will fire against; whether the logic can even trigger on the traffic it targets; missing context (asset criticality, user baseline, direction of the connection); and whether the alert hands the analyst a procedure or just a problem. What you receive, one page: the specific flaws with evidence, a rewritten rule or alert that states who, when, from where, to where, and what to do next, and the blind spots in my own review stated plainly. Background: I write about detection engineering and alert fatigue. Two full sample critiques are public on my profile (a Sigma M365 impossible-travel rule and a suspicious-PowerShell alert) so you can see the format before you buy. One revision included. 3-day delivery. Your rule and any data you send stay private and are deleted after delivery. Log analysis and rule review only, not a host audit; I will say what I cannot see.