noahmagill.com Noah Magill's Blog
Cloud security platform engineer building global-scale detection infrastructure.
-
Querying 100 Million Cilium Hubble Flows on a Macbook with ClickHouse from S3Queue
Designing a ClickHouse schema for Cilium Hubble flow logs, ordering by verdict and time, and querying 100M+ rows from a MacBook with sub-second response times.
-
Elastic Defend Session View: Terminal Replay on Linux
Setting up Elastic Defend as an EDR on a Linux host, triggering a bind shell alert, and replaying the entire attacker terminal session keystroke-by-keystroke with Session View.
-
ownCloud Infinite Scale (oCIS) Tracing and RUM with OpenObserve
Wiring distributed tracing and real user monitoring into ownCloud Infinite Scale using an OTEL collector, an nginx-injected RUM SDK, and OpenObserve as the self-hosted backend.
-
Tetragon Without Kubernetes: Process and Network Events from EC2 to ClickHouse
How to run Tetragon on a standalone EC2 host without Kubernetes, ship its eBPF-captured process and network events through Vector to S3, and query them in ClickHouse, including a recursive query that catches a WordPress compromise.
-
CVE-2026-61343: Librebooking and GLM
How I found an admin RCE in LibreBooking using GLM and DeepSeek, got my first CVE, and what it says about the state of AI-assisted vulnerability research.
-
CCDC: The great, the good, and the ok.
After four years of collegiate cybersecurity competitions, including a CCDC national championship, here are my thoughts on what makes CCDC great, where it struggles, AI in cyber competitions, and the wider comp scene.
No posts match your search.