Detect
Telemetry architecture, triage logic, hypothesis-driven hunts, and detection-as-code patterns.
NOTES FROM A SECURITY PRACTITIONER
Incident response
& AI security,
from the field.
Technical notes, response playbooks, and the things I wish were written down before the incident started.
IndependentEvidence-ledBuilt for defenders
WORKING NOTES / 2026-08LAST UPDATED 28 AUG
CURRENT FOCUSThe first
The first
60 minutes
Stopping autonomous activity, removing unsafe authority, preserving evidence, and bounding downstream impact.
01StopCan the agent still run?
02RevokeWhat authority remains?
03PreserveWhat state will expire?
04ScopeWhat changed downstream?
first-hour rule:
authority before theory
authority before theory
NOTE / 008STATUS / PUBLISHEDREAD / 11 MIN
I keep this site for one reason: useful notes should not stay in private notebooks.
Everything here is authored and reviewed by Leandro Rocha for people who detect, investigate, and contain real attacks. AI-assisted tools may support research, drafting, or editing; technical claims and publication decisions remain the author's responsibility. Read the editorial policy ↗
00 / START HERECHOOSE YOUR OPERATING NEED
Use the site
like a field kit.
Begin with the outcome you need. Each path leads to an operational resource, not a generic content category.
PREPARE A PROGRAM
Build the response system
Establish authority, severity, evidence discipline, containment gates, communications, exercises, and recovery criteria.
Open the framework →RESPOND NOWSelect an incident playbook
Start with scenario-specific evidence, first actions, decision gates, containment, eradication, and recovery.
Choose a playbook ↓ENGINEER AI CONTROLSDefend models, agents, and data
Connect AI incident response to identity, retrieval, independent policy, telemetry, tool use, and rollback.
Open AI Security IR →RUN THE INCIDENTDownload working artifacts
Use structured templates for timelines, evidence, containment decisions, credentials, AI runtime state, and recovery approval.
Browse responder resources →01 / KNOWLEDGE BASEFIELD-GUIDE FORMAT
Start with the problem,
leave with a method.
Each collection connects principles to observable signals, concrete decisions, and reusable artifacts.
↗
Respond
Roles, evidence standards, containment tradeoffs, recovery gates, and communications.
Defend AI
Threat models for agents, RAG, models, data pipelines, tool use, and human approval paths.
02 / RESPONSE PLAYBOOKSOPERATOR-READY
When the signal is real,
reduce uncertainty.
Prescriptive starting points with explicit assumptions. Adapt them to your environment, then validate them in tabletop exercises.
STANDALONE OPERATIONAL RESOURCEIncident Detection &
Incident Detection &
Response Framework
A structured practitioner guide to preparation, detection, triage, containment, eradication, recovery, and lessons learned.
Explore the framework ↗IR-01↗IR-02↗IR-03↗IR-04↗IR-05↗IR-06↗AI-IR-01↗
Ransomware
Decision points from first signal through recovery, with evidence-preservation gates.
Business email compromise
Secure identities, trace mailbox activity, and coordinate payment-risk decisions.
Cloud identity compromise
Revoke sessions, validate persistence, and hunt downstream cloud activity.
Data exfiltration
Confirm access paths, preserve transfer evidence, and bound notification scope.
Repository compromise
Audit code, workflows, dependencies, credentials, and persistence before trusted recovery.
Malware outbreak
Isolate affected assets, collect volatile evidence, and rebuild from trusted sources.
AI / LLM incident
Contain unsafe agency, preserve prompts and traces, and validate a staged rollback.
03 / FIELD NOTES
INCIDENT CLOCK / 008
60:00
LATEST · AI SECURITY · 11 MIN READ
The first 60 minutes
A commander-and-operator timeline for stopping autonomous activity, removing unsafe authority, preserving evidence, and bounding downstream impact.
Read field note →Articles live as simple content files—easy to draft, review, schedule, and share.
Browse all articles ↗