Tag
detection
- Oct 9, 2025 Detecting DNS Tunnels from Query Structure How DNS becomes a bidirectional data channel, which structural properties of queries carry the signal, and why entropy alone is a weak discriminator against legitimate naming schemes. security
- Jun 13, 2024 Decomposing Recovery Time into Detection, Diagnosis, and Mitigation Why a single mean time to recovery mixes intervals with different floors and different distributions, how concurrent incidents queue behind one responder, and how to measure each phase without corrupting the comparison. software engineering
- Feb 16, 2022 From Postmortem to Alert Change: Closing the Detection Loop How a reconstructed timeline becomes a specific detection gap, how action items are classified so they change alerts and runbooks, and how to prove the change took effect. devops