Tracemill Blog https://tracemill.io/blog Articles and reproducible research on detection pipelines. en Detection testing needs a monitor, not a calendar https://tracemill.io/blog/detection-testing-needs-a-monitor-not-a-calendar https://tracemill.io/blog/detection-testing-needs-a-monitor-not-a-calendar Mon, 07 Sep 2026 00:00:00 GMT Article A detection can run successfully while its data is filtered, transformed, or lost. How do you know it still works? TM-2026-001: One add-on upgrade, one blind detection: current Splunk AWS TA fragments AssumedRole recon https://tracemill.io/research/aws-assumed-role-aggregation-fragments-reconnaissance https://tracemill.io/research/aws-assumed-role-aggregation-fragments-reconnaissance Sun, 30 Aug 2026 00:00:00 GMT Investigation A 2025 update to the Splunk Add-on for AWS re-attributes 39 read-only CloudTrail events from the assumed role to the individual session - enough to fragment a role's reconnaissance below AWS Excessive Security Scanning's threshold and silence it. TM-2026-003: Cribl's CloudTrail pack: 60-80% fewer events, eight silent Splunk detections https://tracemill.io/research/cribl-cloudtrail-filtering-drops-aws-read-events https://tracemill.io/research/cribl-cloudtrail-filtering-drops-aws-read-events Tue, 25 Aug 2026 00:00:00 GMT Investigation An A/B validation of 38 Splunk ESCU AWS detections with the official CloudTrail pack in and out of the data ingestion pipeline, or what a cost-saving reduction quietly does to your detections.