Security
Defense in Depth
- HTTPS via Cloudflare DNS-01 certificate renewal
- All backends bound to
127.0.0.1
- JSON access logs feed CrowdSec in real time
forward_auth on every Caddy route- Two-factor: passkey + biometric or TOTP
- OIDC provider for Grafana
- Community blocklists + log analysis
- Bouncer queries LAPI every 15s
- Collections: caddy, authelia, http-cve
- 5 scheduled analytics rules + a router SSH brute-force rule over the native Syslog table
- Deployed as code with Bicep — no click-ops
- "Homelab Security Operations" workbook for triage
- SOAR notification playbook (Logic App) on incident creation
Cloud Security Operations
Microsoft Security Stack
The self-hosted SIEM was retired in favor of the same enterprise tooling used in production security operations.
- 5 custom detection rules (KQL), sourced from Sigma
- 2-device managed fleet — Windows + macOS — onboarded to Defender for Endpoint
- EDR telemetry feeds advanced hunting for both devices
- Windows + macOS compliance baselines defined as code
- Attack Surface Reduction rules deployed in audit mode
- macOS Defender onboarding profiles pushed via Intune
- Both fleet devices report Compliant
- Foundational cloud security posture management (CSPM)
- Compliance tracked against MCSB and CIS benchmarks
Endpoint · Network · CTI
Threat Detection
Layered detection across hosts, the network edge, and live threat intelligence.
⚡
Defender Custom Detections
- Suspicious child from Office / Browser —
T1566.001
- Encoded / download commands —
T1059.001
- Lsass credential access —
T1003.001
- Remote thread injection —
T1055
- Registry persistence & C2 named pipes
- Microsoft Defender Threat Intelligence (MDTI) data connector
- AlienVault OTX via TAXII
- abuse.ch ThreatFox via STIX upload
- ~206,000 indicators feeding Sentinel analytics rules
📡
Suricata IDS & netifyd DPI
- Suricata in LXC on GL-BE9300 — shares host netns, sniffs
br-lan
- netifyd nDPI engine — flow classification with
ndpi_risk_score
- High-risk flows forwarded via syslog into Sentinel's native Syslog table
- Router SSH brute-force rule tags matches with MITRE
T1110
Detection Engineering
Detection-as-Code
Detections are source-controlled, tested, and deployed like any other code.
- Sigma rules are the single source of truth for every detection
- GitHub Actions: Sigma validation, rules-in-sync check, Bicep build, schema checks on every PR
- OIDC deploy to Azure on merge — no stored cloud credentials
- Main is branch-protected
🧪
Continuous Purple-Team Validation
- Isolated MDE-onboarded detonation-range VM, separate from the production fleet
- Validation loop runs Atomic Red Team techniques against the VM
- Each run auto-confirms the matching detection fired, via advanced hunting
- Emits an ATT&CK Navigator coverage layer after every run
- First run caught 2 custom detections that filtered on an empty field and would have never fired
The validation harness caught bugs that code review couldn't: two detections keyed on the wrong field — for CreateRemoteThreadApiCall and OpenProcessApiCall the target process lives in FileName, not AdditionalFields.TargetProcessName — so they would have stayed silent forever.