20 000 Alerts a Second on One Desktop: What an Alert-to-Incident Pipeline Actually Costs

A load-test exercise on an alert-to-incident pipeline: 18 deterministic edge-case scenarios against real Kafka and PostgreSQL, sustained rates from 6000 to 20 000 alerts per second, and a worker pool made horizontally scalable and fail-safe with a work-queue table and one PostgreSQL clause – FOR UPDATE SKIP LOCKED. Continue Reading →

Extracting Windows system Interactive Logon information to CSV file (Time, account name, IP address)

Short script to extract Interactive logon information from Windows security event log and save it to CSV file. Empirically i fond a filter which show both console logons and logons Continue Reading →