Sysmon on Kyle Versluishttps://ktalons.github.io/tags/sysmon/Recent content in Sysmon on Kyle VersluisHugoenSun, 09 Aug 2026 00:00:00 +0000Phase A: Active Is Not Proofhttps://ktalons.github.io/blog/phase-a-active-is-not-proof/Sun, 09 Aug 2026 00:00:00 +0000https://ktalons.github.io/blog/phase-a-active-is-not-proof/Phase A is complete: agents on three real endpoints, Suricata on the wire, and a SOC dashboard in git. The recurring lesson: Active is a liveness signal, not an acceptance test.