Now

Updated September 4, 2026

Both MCP servers are shipped and public: mcp-defender-xdr for hunting across Microsoft Defender XDR tenants, and mcp-sentinel-detection-engine for the Sigma → KQL → Microsoft Sentinel Terraform pipeline. Hunt there, ship detections from here. The work now is hardening both toward v0.2: live workspace schema fetching, HTTP/SSE transport alongside stdio, and per-tenant rate-limit handling.

• SC-200 earned. Preparing for the Anthropic Claude Certified Architect – Foundations (CCAR-F).
• Writing a post on detection engineering with Claude.

This is a /now page — what I'm focused on at this point in my life. Updated roughly monthly.