Nobody reads your alerts, and it isn't their fault
Alert fatigue is usually blamed on analysts. It's almost always a design problem — and design problems can be fixed.
Notes from the field
Blog
Threat detection, incident response and the unglamorous engineering that makes security work in the real world.
Writing an incident report your executives will actually read
The technical timeline is the easy part. The hard part is the one page that decides whether anything changes afterwards.
How to add a post to this site
A working example of the markdown this site supports — and the three-step routine for publishing something new.