There's no content team behind DataSec Chronicles. There's just me, a full-time career, a family, and a lot of open tabs. Here's how I actually build all of this — and what I'd tell anyone asking where to start.

Part 2 of the Zeek threat hunt: using SQL to detect C2 beaconing on a fixed cadence, internal reconnaissance across 771 hosts, and a confirmed SSH intrusion — plus the timeline that showed the network was compromised before the attacker I could see ever logged in.