Writing · Field Notes
posts
5
tracks
3
Notes from the firehose.
Pieces on platform internals, AI agents that consume live signal, and the security patterns that emerge when you stop waiting on logs.
2026-05-21·8.5 min read·
We built a managed firehose where the producer is the network itself
Architecture, trade-offs, and a working code snippet — why we chose UDP from probe to collector, in-memory enrichment, and cumulative counters on every event.
2026-05-15·1 min read·
Welcome to Signal Fabric
Why we built a single enriched WebSocket for every packet on every network.
2026-05-10·1 min read·
Building Agents on the Firehose
How AI agents reason over enriched flow records in real time.
2026-05-04·6 min read·
JA4 Fingerprints in Practice
Using JA4 and JA4S to catch encrypted traffic anomalies without breaking TLS.
2026-04-30·5 min read·
Most TIP feeds are mostly noise
A blunt assessment of where threat-intel feeds actually add value, where they waste analyst time, and how to tell which is which.