Detection testing needs a monitor, not a calendar
A detection can run successfully while its data is filtered, transformed, or lost. How do you know it still works?
- Detection engineering
- Continuous validation
Tracemill Blog
What breaks between source and alert.
Articles and reproducible investigations into detection pipelines. Research follows numbered investigations and their evidence rules. Articles make an argument without borrowing that label.
TM-2026-001
One add-on upgrade, one blind detection: current Splunk AWS TA fragments AssumedRole recon
A 2025 update to the Splunk Add-on for AWS re-attributes 39 read-only CloudTrail events from the assumed role to the individual session - enough to fragment a role's reconnaissance below AWS Excessive Security Scanning's threshold and silence it.
- AWS
- CloudTrail
- Splunk
- IAM
TM-2026-003
Cribl's CloudTrail pack: 60-80% fewer events, eight silent Splunk detections
An A/B validation of 38 Splunk ESCU AWS detections with the official CloudTrail pack in and out of the data ingestion pipeline, or what a cost-saving reduction quietly does to your detections.
- AWS
- CloudTrail
- Cribl
- Splunk
Follow new articles and investigations via RSS.