SURIQExplainers
Clear, practitioner explainers of the core security concepts: what each one is, how it actually works, and where it breaks.
How to Use Syslog in Linux: Read, Write and Forward Your Logs
How to use syslog in Linux: read logs with journalctl and /var/log, write entries with logger, and forward them over TCP with an rsyslog queue that survives
How to Use the Wazuh Agent: Configure, Group, and Troubleshoot It
How to use the Wazuh agent: enroll it into a group, manage its settings centrally with agent.conf, and fix agents stuck as Never connected or Disconnected.
How to Write an Incident Response Plan That Works Under Pressure
How to write an incident response plan: severity levels tied to real alerts, roles, runbooks, pre-approved containment, evidence, and a tested worked example.
How to Use Wazuh as an EDR: Detection and Active Response
How to use Wazuh as an EDR: the real config for endpoint detection, Sysmon ingestion, and scripted active response, plus where it stops short of a full EDR.
How to Use wazuh-logtest to Debug Wazuh Decoders and Rules
How to use wazuh-logtest to test Wazuh decoders and rules: run the CLI, read all three phases, use verbose mode, and fix a rule that will not fire as expected.
WHMCS CVE-2026-67399: Stopgap Hook If You Cannot Upgrade Yet
A defense-in-depth WHMCS hook that blocks the payload classes CVE-2026-67399 most likely needs, for installs that cannot reach 8.13.7 or 9.0.8 yet. Not a fix.
Unisoc modem flaw lets an answered video call take over the Android kernel, and there is no patch
A two-stage exploit turns a VoLTE video call into full Android kernel access on phones with Unisoc modems. No patch exists; only the chipset maker can fix it.
Public DNS servers with filtering: a verified list of what each IP really blocks
Public DNS servers with filtering, verified against official docs: what the Cloudflare, Quad9, AdGuard, CleanBrowsing, ControlD, Mullvad and OpenDNS IPs block.
How to Use the Wazuh API: Authenticate, Query Agents, and Automate
How to use the Wazuh API: authenticate on port 55000 for a JWT token, then query your agents and automate with copy-pasteable curl commands and a worked
How to Use Wazuh: A Practitioner's Guide to Agents, the Dashboard, and Detection
How to use Wazuh: install the server, enroll an agent, reach the dashboard, and write and test a detection rule with wazuh-logtest.
What is MITRE ATT&CK? Tactics, techniques, and how defenders actually use it
A plain-English guide to MITRE ATT&CK: what it is, how its tactics and techniques are organized, a real intrusion mapped step by step, and how defenders use it.
What is a SIEM, in plain terms (and how it differs from a SOC and EDR)
What a SIEM is, what it actually does, and how it differs from a SOC, an EDR, and plain log management - explained by a team that runs one.
See what Suriq finds on your own servers.
Agentless checks for uptime and your cloud, a lightweight agent for detection on each server, and one console that ranks and explains what it finds.