Writeups

Notes on building Triagewall in public — architecture, experiments, and the things that broke.

• Adding a Detection Layer That Prompt Injection Can’t Touch

  June 11, 2026

  Behavioral baselining on the bare Suricata alert stream — no flow logs, no extra telemetry. An injection-resistant detection layer, and what calibrating it on 1.5M real alerts taught me.

• I Found a Prompt Injection in My Own IDS Triage Tool. Here’s What Actually Stopped It.

  May 25, 2026

  I attacked my own LLM-based Suricata triage tool, found a real URL injection vulnerability, and the obvious fix didn’t work. Here’s what did.

• How I Cut 13,000 Suricata Alerts an Hour Down to 200 Worth Reading

  May 18, 2026

  Building a two-tier local-LLM triage layer for a homelab IDS — architecture, the numbers, and what broke when I tested it on a 2018 laptop.