Rule Writing

detecting-container-escape-with-falco-rules helps detect container escape attempts with Falco runtime security rules. It focuses on syscall signals, privileged containers, host-path abuse, validation, and incident response workflows for Kubernetes and Linux container environments.

configuring-snort-ids-for-intrusion-detection skill for installing, configuring, validating, and tuning Snort 3 IDS on authorized network segments. Includes practical usage, rule loading, CLI checks, false-positive reduction, and Security Audit workflows.