Start here: what ENTROPY//WATCH is, and who it's for

Every environment produces entropy: logons, process starts, DNS lookups, ticket requests, configuration drift. Most of it is harmless. Somewhere in it is the one event that matters. Defensive security is the craft of telling the two apart — fast enough, and reliably enough, that someone can act on it.

ENTROPY//WATCH is where we write that craft down. Not the conference-talk version, but the version that survives contact with a real network: the rule that fires thousands of times on a Monday morning and how to fix it, the playbook step everyone skips, the audit setting that silently makes a detection blind.

Who this is for

You will probably get something out of this site if you are:

• A SOC analyst who wants to understand why an alert fires — and when it is lying to you.
• A detection engineer building and tuning rules for Wazuh, Microsoft Sentinel or Defender, and looking for tested starting points rather than vendor marketing.
• A sysadmin or IT generalist who became “the security person” by accident, and needs practical baselines instead of a 300-page framework.
• An incident responder who wants playbooks that work at 3 a.m., written by people who have used them at 3 a.m.
• Someone moving into blue or purple team work — from IT operations, development or study — who learns best from worked examples.

It is probably not for you if you are looking for offensive tooling or exploit write-ups. We do run attacks — in a lab, with public, well-known emulation tools such as Atomic Red Team — but only to prove that a detection fires and to see what it misses. Every emulation published here ends in a rule, a logging setting or a hardening step.

What you’ll find

Articles are the long-form research: a full detection baseline for a platform, a technique explained from the log line up, a coverage review against MITRE ATT&CK, or a platform comparison built around your environment rather than a feature checklist — every fact linked to its source. They take time to write and they are meant to be kept open in a tab while you work.

Field notes are shorter and rougher: what broke this week, what we tuned, what we would do differently. Less polish, faster delivery.

The armory holds the artifacts behind both — detection rules, scripts, configurations and playbooks you can download and use. Every file has its SHA-256 next to it, a license (MIT for code, CC BY 4.0 for documents) and, where it is a text format, a syntax-highlighted preview so you can read it before you run it.

How we write

A few rules we hold ourselves to:

1. Tested against real telemetry. If a rule is published here, it has been run against actual events, and the article tells you how to test it yourself before you trust it.
2. Mapped to ATT&CK, honestly. A technique ID on a rule means the rule detects that technique — not that it is vaguely related.
3. Noise is part of the design. Every detection comes with what it costs: expected false positives, what to tune, and what to filter.
4. Proven by emulation where we can. When a technique can be safely reproduced in a lab, we run it and show what was logged and whether the rule fired — not just what should happen in theory.
5. Nothing from real environments leaks out. Hostnames, accounts, IP ranges and anything else that would help an attacker map a network are replaced with neutral examples before publication.
6. Corrections are welcome and visible. When we get something wrong, the article is fixed and the fix is noted.

Getting the most out of the site

• Search everything — press / on any page. The index covers articles, notes and the contents of downloadable files, so searching for an event ID such as 4769 finds the rules that use it.
• Use the console on the homepage. It is a working terminal: feed --latest, ls detections, search kerberoasting, help. The telemetry panel above it shows what has been published and when.
• Follow the RSS feed if you want new articles, notes and downloads without checking back. There are no newsletters, trackers or cookies here — RSS is the whole subscription model.
• Filter and sort the article list, field notes and the armory by tag, type and date.

Talk to us

Spotted a mistake, a false-positive pattern or a gap in a ruleset? Write to hello@entropywatch.dev.

Found a security issue in this site itself? Please report it to security@entropywatch.dev — our security.txt is signed, and our PGP key is available if you want to encrypt the report.

The first technical articles and the armory are on their way. Welcome to the watch.

Updated 2026-10-17: platform comparisons are now in scope; removed them from the list of things we don’t cover.

Updated 2026-10-17: we now describe ourselves as a purple team — lab emulation to validate detections is in scope, offensive tooling and exploit write-ups still are not.