~/blog / field notes

Field Notes

Working notes on backend systems, security, and applied ML. Written to be copied into a terminal, not admired.

Entries
10
Words
14,174
Last revised
2026-09-01
Topics
████░░ Security█░░░░░ Python█░░░░░ AI & Automation
Feed
RSS ↗
§ Start here

One pinned entry, chosen by hand. The thing a new reader should open first.

2026
10 Wazuh Detection Engineering, Part 4: Tuning Out Noise Without Going Blind Tune from data: pull alert counts per rule id from the indexer, and fix the top ten before touching anything else. Ten rules usually make up most of the volume. Security · 9 min 09 Wazuh Detection Engineering, Part 3: Active Response That Cannot Lock You Out Active response is analysisd calling a script on a rule match. The script gets the full alert as JSON on stdin, and stateful scripts get a matching delete call when the timeout expires. Security · 9 min 08 Wazuh Detection Engineering, Part 2: Decoders and Rules for Your Own Logs JSON logs need no decoder; the built-in one flattens fields you can match with <field>. Plain-text logs need a parent decoder with a prematch and children that extract fields with regex and order. Security · 8 min 07 Wazuh Detection Engineering, Part 1: How an Event Becomes an Alert A Wazuh alert is the output of a fixed pipeline: agent collects, remoted receives, analysisd decodes then matches rules, and the indexer stores what scored above the alert level. Security · 8 min
2025
06 Building Scalable CLI Applications with Typer Typer turns typed Python functions into CLIs with argument parsing, help text, and validation for free. Python · 3 min
2024
05 The Journey to Autonomous Security - Building SentinelFlux SentinelFlux connects Wazuh detections to an agentic responder built on LangGraph. Security · 1 min 04 Building a Production-Ready Voice AI Agent with <500ms Latency Under 500 ms round trip with streaming speech-to-text from Deepgram, OpenAI for reasoning, and streaming TTS. AI & Automation · 3 min 03 Building an MCP Task Manager with Agentic Patterns A Model Context Protocol server exposes tools Claude can call to create, list, prioritise, and complete tasks in SQLite. AI & Automation · 7 min 02 Securing FastAPI Applications: A Comprehensive Guide JWT auth with bcrypt hashing, short-lived tokens, and a dependency that guards routes. Security · 9 min 01 UV: The Lightning-Fast Python Package Manager Replacing pip, Poetry, and pipenv uv replaces pip, pip-tools, virtualenv, and Poetry with one Rust binary that resolves and installs 10 to 100 times faster. Python · 7 min
§ Reading paths
04 entries

Detection engineering with Wazuh

  1. Wazuh Detection Engineering, Part 1: How an Event Becomes an Alert
  2. Wazuh Detection Engineering, Part 2: Decoders and Rules for Your Own Logs
  3. Wazuh Detection Engineering, Part 3: Active Response That Cannot Lock You Out
  4. Wazuh Detection Engineering, Part 4: Tuning Out Noise Without Going Blind
02 entries

Securing services

  1. Securing FastAPI Applications: A Comprehensive Guide
  2. The Journey to Autonomous Security - Building SentinelFlux
02 entries

Agent systems

  1. Building an MCP Task Manager with Agentic Patterns
  2. Building a Production-Ready Voice AI Agent with <500ms Latency
02 entries

Python toolchain

  1. UV: The Lightning-Fast Python Package Manager Replacing pip, Poetry, and pipenv
  2. Building Scalable CLI Applications with Typer