// field notes on devsecops & cybersecurity

Breaking things
to understand them.

I’m Nadim Saliby, a security researcher. This is where I document what I break, what I build, and what I learn along the way, in enough detail that you can reproduce it yourself.

06 posts/ 141 min of reading/ last update aug 19, 2026

Index.

  1. Cloud Security35 min read Registry as a Sensor: Wiring Harbor and Trivy into Wazuh, with a Wolfi Agent to Prove It A Harbor→Wazuh webhook bridge, a 25-rule supply-chain detection pack with three correlation chains (vulnerable image deployed, unscanned image deployed, already-deployed image found vulnerable), and a Wazuh agent rebuilt from source on Wolfi that scored 0 CVEs against the official manager image's 567. Validated live on Wazuh 4.14.5: 23 of 25 rules fire from one script, 40 alerts.
  2. Cloud Security23 min read Wazuh on K8s: 7 Frameworks, Auto-Remediation, One Chart An open-source Helm chart that wraps Wazuh agents with Kubernetes-native enforcement: CIS, NIST 800-53, PCI-DSS, HIPAA, SOC2, MITRE ATT&CK runtime detection, admission webhook, and a remediation CronJob: all from one deploy.
  3. Cloud Security25 min read Closing the Kernel-Level Gap in Wazuh: an eBPF Sidecar with Tetragon A custom Wazuh rule pack and reproducible Docker lab that pairs a stock Wazuh agent with a Tetragon eBPF sidecar to catch what stock Wazuh cannot: short-lived process exec, fileless memfd payloads, sub-second TCP connects, kernel module loads, bpf() syscall use, sensitive-file argv reads, setuid escalation. 1 decoder family, 15 rules, 4 distros, 1.59M events validated.
  4. Cloud Security30 min read Catching Shadow AI in the Network: DNS, Egress, and Browser Telemetry with Wazuh A custom Wazuh rule pack and reproducible Docker lab that catches browser-side shadow AI on developer endpoints: DNS lookups, TLS egress, extension manifests, and native messaging hosts. 4 decoders, 15 rules, MITRE ATT&CK mapped, validated live on Wazuh 4.14.5.
  5. Cloud Security25 min read Detecting Rogue MCP Servers and Shadow AI Agents on Endpoints with Wazuh A custom Wazuh rule pack and reproducible Docker lab that catches rogue MCP servers, shadow AI agent activity, and indirect prompt-injection chains on engineering endpoints. 6 decoders, 17 rules, MITRE ATT&CK mapped, validated live on Wazuh 4.14.5.
  6. Web Security3 min read Wazuh Migration: Missing Historical Alerts What caused historical alerts to disappear from Wazuh dashboards after migration, and the safer reindex workflow that fixed it.