daemon_
security // logs // field notes
Notes from an MSSP detection-platform operator. What we ship, what we break, and what scales when a single SOC team is responsible for thirty client environments.
Sanitized writeups of platform work — Entrigen, SOC-OS, the IOC pipeline — incoming.
For now, see operator(8).
Neil Cushard — Director of Security Services, MSSP architect. Building
Entrigen, a model-driven security operations framework serving 30 client environments
and scaling toward 120. Five modules online; SOC-OS is the first daily driver.
Adjacent work: a synthetic alert generator that replaced our SOAR mock fleet, an IOC pipeline pulling 2.8M active indicators from MISP into a Tines-backed lookup, and a detection content pipeline that tracks per-tenant drift instead of forking rules.