Custom Falco macros + rule overrides watch /etc/shadow, passwd, sudoers. Tracks openat, unlinkat, write; context-aware to separate apt/dnf updates from https://www.valtersit.com/vault/detecting-sensitive-file-modifications-via-falco-macro-and-r-d3b539/ #falco #linux #ValtersIT

Scan millions of files with YARA without single-thread bottleneck. GNU Parallel plus pre-compiled bytecode splits paths across CPU workers on RHEL https://www.valtersit.com/vault/multithreaded-batch-scanning-via-gnu-parallel-and-precompile-d09716/ #yara #gnu-parallel #ValtersIT

Hardened systemd unit for Chaos Monkey: PrivateMounts, ProtectSystem=strict, cap restrictions stop privilege escalation. https://www.valtersit.com/vault/hardening-systemd-unit-execution-for-the-chaos-monkey-daemon-d20508/ #systemd #chaosmonkey #ValtersIT

Deploy Aqua Enforcer as a DaemonSet via Helm to protect every K8s node. eBPF + kernel syscall tracking for runtime security on RHEL 8/9, Ubuntu 22.04. https://www.valtersit.com/vault/deploying-aqua-enforcer-daemonset-for-runtime-kubernetes-nod-83004a/ #aqua #kubernetes #ValtersIT

Run ZeroTier in an unprivileged Docker sidecar via TUN mapping for zero-trust container networking. https://www.valtersit.com/vault/deploying-zerotrust-container-networking-via-docker-sidecar--d340b0/ #zerotier #docker #ValtersIT

Inject Aqua MicroEnforcer into app images during multi-stage Docker builds. It wraps the entrypoint, monitors syscalls in user-space, enforces policy https://www.valtersit.com/vault/embedding-aqua-microenforcer-in-multistage-builds-for-server-161975/ #aqua #docker #ValtersIT

Redis 7.0 Sharded Pub/Sub binds channels to hash slots, so messages stay on the primaries/replicas that own the slot instead of broadcasting to every https://www.valtersit.com/vault/redis-70-sharded-pubsub-ssubscribe-for-cluster-horizontal-sc-b53d4e/ #redis #sharding #ValtersIT

Lock down supervisord: use a local UNIX socket with chmod/chown instead of a TCP port. No network exposure, group-owned access, Medusa HTTP https://www.valtersit.com/vault/secure-unix-socket-control-interface-with-strict-file-permis-d86b48/ #supervisor #hardening #ValtersIT

gnmic server mode acts as a gNMI Dial-Out collector. Devices open gRPC to port 57400 and push telemetry via Publish RPC. Decode protobuf, stream to https://www.valtersit.com/vault/receive-networkinitiated-telemetry-with-gnmic-gnmi-dialout-c-db1d8c/ #gnmi #openconfig #ValtersIT

Test Falco rules with synthetic incidents. Run the event-generator in Docker to spawn shells, modify binaries, and read sensitive files, producing https://www.valtersit.com/vault/simulating-security-incidents-using-event-generator-for-rule-8c6b5b/ #falco #testing #ValtersIT

Pipe kustomize build into kubeconform to validate rendered K8s manifests against JSON schemas. Catches bad fields, type mismatches, missing required https://www.valtersit.com/vault/validate-manifests-with-kubeconform-and-kustomize-build-71fbeb/ #kubernetes #kustomize #ValtersIT

gNMI over mTLS: strict cert + SAN validation both ways. Full walkthrough: https://www.valtersit.com/vault/secure-gnmi-transport-with-strict-mutual-tls-authentication--eed5fc/ #gnmi #tls #ValtersIT

Chaos Monkey v2 TOML config for AWS ASG termination control: schedule, MTBF, blacklists, deployment filters. Full file at https://www.valtersit.com/vault/configuring-chaos-monkey-toml-file-for-aws-auto-scaling-term-6feaa3/ #chaosmonkey #aws #ValtersIT

YARA -f short-circuits string eval: stops at first match per string instead of scanning all offsets. Big throughput win in pipelines. https://www.valtersit.com/vault/shortcircuiting-string-evaluation-with-fast-scan-mode-in-hig-1b9906/ #yara #fast-scan #ValtersIT

Nebula Lighthouse on Ubuntu/Debian/RHEL: static UDP listener maps public IPs to overlay addresses, tracks endpoints and port mappings from UDP https://www.valtersit.com/vault/setting-up-a-public-lighthouse-node-for-peer-discovery-and-n-175f7e/ #nebula #nat-traversal #ValtersIT

Schedule Chaos Monkey runs only in defined windows with systemd timers. Ephemeral execution, zero background load outside those times. https://www.valtersit.com/vault/restricting-chaos-executions-via-systemd-timers-with-timewin-1bc3a3/ #chaos #systemd #ValtersIT

Audit every S3 bucket for public access blocks, policy status, and default KMS encryption with one AWS CLI script. Scores risk per bucket for ISO 27001 https://www.valtersit.com/vault/aws-s3-bucket-public-exposure-and-kms-encryption-risk-assess-833804/ #aws #s3 #ValtersIT