I work in cybersecurity, focusing on incident response, threat hunting, and detection engineering.

This site is where I write up things I’ve worked through - investigations, detection logic, tooling notes. The goal is to document the reasoning, not just the outcome: what the initial signal looked like, which paths turned out to be dead ends, and what would have made the detection faster. Most write-ups are anonymized, with identifying details removed or changed.

I’m interested in the parts of the job that don’t fit neatly into a playbook, the noisy alerts, the gaps between what a tool claims to cover and what it actually catches, and the lessons that only surface after an incident is closed.

Posts are mostly in English, occasionally in Turkish.

Contact

If you spot an error in something I’ve written, I’d rather hear about it than not.