You Can’t Just Paste Logs Into an LLM
The first idea everyone has is to point a language model at their logs. It demos beautifully and falls apart on arithmetic. A look at why — and why the model was never the hard part.
Process Ancestry Lies to You: Reading Parent-Child Relationships Without Getting Fooled
Parent-child process relationships are the backbone of behavioural detection — and they break in more ways than most detection engineers expect. A practical guide to PID reuse, PPID spoofing, orphan reparenting, and what to do about each.