No cloud account, no labeled attack data — just SQL and Python on 2.8 million network flows. An Isolation Forest flagged suspicious traffic blind, and tuning it surfaced a counterintuitive truth about where attacks actually hide. A data analyst's field notes from the pivot into security.

Part 2 of the Zeek threat hunt: using SQL to detect C2 beaconing on a fixed cadence, internal reconnaissance across 771 hosts, and a confirmed SSH intrusion — plus the timeline that showed the network was compromised before the attacker I could see ever logged in.