Nguyen Dong

I write and test Wazuh rules, decoders and ingest pipelines for your exact version. Fixed scope, paid only after it runs on your cluster.

Joined on Mar 6, 2026 https://vct.atkvn.com/#fix-pack

Nguyen Dong

Oct 4

A single pfSense block never becomes a Wazuh alert. Here is why, measured.

#wazuh #pfsense #security

3 min read

Want to connect with Nguyen Dong?

Create an account to connect with Nguyen Dong. You can also sign in below to proceed if you already have an account.

Create Account

Already have an account? Sign in

Nguyen Dong

Oct 3

Wazuh 5.0 will not load your custom XML rules. 82% of one public pack depends on what it drops.

#wazuh #security

3 min read

Nguyen Dong

Oct 2

wazuh-analysisd shows at most 50 load warnings. The rest of your ignored rules are silent.

#wazuh #security

3 min read

Nguyen Dong

Oct 1

Three reasons a custom Wazuh rule stays silent after a clean config check, measured on 4.14.7

#wazuh #detectionengineering #security #linux

5 min read

Nguyen Dong

Sep 30

Hybrid post-quantum key exchange at the front door went from 50% to 86%. It says nothing about your VPN.

#cryptography #postquantum #tls #security

3 min read

Nguyen Dong

Sep 28

Wazuh loses events three ways under load, and only one of them raises an alert

#wazuh #logging #security #linux

3 min read

Nguyen Dong

Sep 26

Wazuh custom rule never fires, and analysisd -t still exits 0: the file name decides

#wazuh #detectionengineering #security #linux

3 min read

Nguyen Dong

Sep 26

Wazuh ms-graph: why Entra ID sign-ins never reach the indexer, and a one-processor fix

#wazuh #microsoft365 #opensearch

7 min read

Nguyen Dong

Sep 24

One field path, two shapes: how Wazuh alerts get dropped with a 400 nobody sees

#wazuh #security #opensearch

2 min read

Nguyen Dong

Sep 23

All 4052 if_sid anchors in the Wazuh ruleset resolve, so that's not why your rule is silent

#security #devops #opensource #linux

2 min read

Nguyen Dong

Sep 21

Sixteen detection vendors, one TLS check, and nobody is near the 47-day floor

#security #tls #devops #sysadmin

3 min read

Nguyen Dong

Sep 17

Two coverage zeros, two different causes

#wazuh #security #kubernetes #devops

3 min read

Nguyen Dong

Sep 9

I scanned 37 security job posts tonight. Zero were posted in the last 24 hours.

#security #freelance

2 min read

Nguyen Dong

Sep 7

Your SIEM has never been asked a question it could fail

#security #wazuh #devops

2 min read

Nguyen Dong

Sep 6

A rule that is present, enabled, and silent: what Wazuh 92900 shows about coverage reports

#security #wazuh #cybersecurity

2 min read

Nguyen Dong

Sep 3

We replayed 24 ATT&CK techniques against a default Wazuh install. Three raised an alert.

#wazuh #security

4 min read

Nguyen Dong

Sep 3

In April, banking was the least post-quantum-ready sector we measured. It is now second from the top.

#postquantum #cryptography #security #tls

4 min read

Nguyen Dong

Mar 10

HIDS + NIDS: Why Your SMB Needs Both (And How We Integrated Wazuh + Suricata in a Single Platform)

#cybersecurity #wazuh #suricata #startup

4 min read

DEV Community

Nguyen Dong

Badges

1 Week Community Wellness Streak

Writing Debut

A single pfSense block never becomes a Wazuh alert. Here is why, measured.

Want to connect with Nguyen Dong?

Wazuh 5.0 will not load your custom XML rules. 82% of one public pack depends on what it drops.

wazuh-analysisd shows at most 50 load warnings. The rest of your ignored rules are silent.

Three reasons a custom Wazuh rule stays silent after a clean config check, measured on 4.14.7

Hybrid post-quantum key exchange at the front door went from 50% to 86%. It says nothing about your VPN.

Wazuh loses events three ways under load, and only one of them raises an alert

Wazuh custom rule never fires, and analysisd -t still exits 0: the file name decides

Wazuh ms-graph: why Entra ID sign-ins never reach the indexer, and a one-processor fix

One field path, two shapes: how Wazuh alerts get dropped with a 400 nobody sees

All 4052 if_sid anchors in the Wazuh ruleset resolve, so that's not why your rule is silent

Sixteen detection vendors, one TLS check, and nobody is near the 47-day floor

Two coverage zeros, two different causes

I scanned 37 security job posts tonight. Zero were posted in the last 24 hours.

Your SIEM has never been asked a question it could fail

A rule that is present, enabled, and silent: what Wazuh 92900 shows about coverage reports

We replayed 24 ATT&CK techniques against a default Wazuh install. Three raised an alert.

In April, banking was the least post-quantum-ready sector we measured. It is now second from the top.

HIDS + NIDS: Why Your SMB Needs Both (And How We Integrated Wazuh + Suricata in a Single Platform)