What if Sigma detection rules were just SQL? RSigma now converts 3,800+ SigmaHQ rules to native PostgreSQL queries. JSONB, views, TimescaleDB continuous aggregates, temporal correlation; all from YAML. No SIEM. Just psql, pg_cron, and Grafana. mostafa.dev/building-a-d...

RSigma v0.8.0 is out! New conversion engine turns Sigma detection rules into backend-native queries. First backend: PostgreSQL/TimescaleDB, with no equivalent in pySigma. Multi-arch Docker images, one-to-many field mapping, and full filter parity. github.com/timescale/rs...

I wrote a new blog post, where I streamed events to RSigma with four SigmaHQ Okta rules, and watched it correlate individual detections into a single critical alert. Each detection alone? Noise. All four from the same actor in 30 minutes? Incident. mostafa.dev/streaming-lo...

RSigma v0.7.0, the "any log format", is out! The Sigma detection engine now ingests JSON, syslog, logfmt, CEF, and plain text with auto-detection. 1M+ events/sec on JSON, 10M+/sec on plain text. Inspired by Sigma Engine by Sigma HQ. github.com/timescale/rs...

My project, RSigma, and the associated blog post are published in Zack Allen's latest newsletter, Detection Engineering Weekly. 🎉 www.detectionengineering.net/p/dew-149-ro...

I just published a new article about a project I've been working on past couple of weeks: mostafa.dev/declarative-...

What if jq could hunt threats, too? mostafa.dev/fab16334e4ee

Over the past couple of weeks I've been busy cooking something in Rust. A generic HTTP API log collector for audit trails: github.com/timescale/helr And a parser, linter, evaluator and backend for Sigma in Rust along with an experimental LSP: github.com/timescale/rs...

xk6-kafka v1.2.0 is out! 🚀 This release brings an updated k6 baseline, a new Avro implementation, better precision and resiliency around time handling, balancer functions in JS, plus a handful of quality-of-life and security linting fixes. github.com/mostafa/xk6-...

I just published a new article on GCP canary tokens by turning Google Cloud service accounts into high-signal tripwires. mostafa.dev/gcp-canary-t...

I just published a new blog post: "Detection as Code". I break down what detection & response really means in practice, how Sigma fits into the picture, and a brief intro to the Sigma Rule Deployment (SRD) project we built during my time at Grafana. mostafa.dev/detection-as...

I'm happy to share that I'm starting a new position as Lead Security Engineer at Tiger Data (creators of TimescaleDB)!

I've been accepted into the Google Developer Experts Academy! I'm working toward becoming a GDE in Cloud, with a strong focus on security.

After nearly five months of development and testing, I'm truly content to share that the auto-fix feature is now stable in v1.15.0. 🎉 Epic ticket: github.com/zizmorcore/z... Release announcement: github.com/zizmorcore/z... Blog post: mostafa.dev/github-actio... Crate: crates.io/crates/yamlp...

I will be speaking at Devfest Berlin on November 22, 2025, presenting a session called "Tiny Little Birds", where I talk about canary tokens. The talk is based on my recent blog post on Grafana Labs blog: grafana.com/blog/2025/08... I look forward to seeing many of you in Berlin.

The Sigma Rule Validator project, that I created and we donated to the Sigma project, is now being used in two security training courses: 1. CJDE from Security Blue Team 2. Detection Engineering with Sigma by Applied Network Defense blog.sigmahq.io/how-to-valid...

Happy to see my article on canary tokens featured again, this time in the "CTO at NCSC" newsletter! ctoatncsc.substack.com/i/172751253/... Big thanks to Ollie Whitehouse for the mention. Here's original write-up on the Grafana Labs blog: grafana.com/blog/2025/08...

Excited to see my write-up on canary tokens at Grafana Labs featured in this week's Detection Engineering Weekly! grafana.com/blog/2025/08... Big thanks to the Detection Engineering Weekly team for the shout-out! 🙌 👉 Read the full issue here: www.detectionengineering.net/p/dew-131-ne...

The SAML SSO package I've been maintaining surpassed 1 million downloads. 🎉 As promised, the second part is now live. In this article, I'll show you how to configure a fresh Django app to authenticate with Okta using the SAML 2 protocol: mostafa.dev/saml-sso-in-...

Thanks @thinkstcanary.canary.tools for making this awesome platform! 🙌 If you still haven't read my blog post, here it is: grafana.com/blog/2025/08...

I haven't been mentioned once, but twice, in the [tl;dr sec] newsletter #297 about my two recent articles on canary tokens and zizmor. 🎉🙌 tldrsec.com/p/tldr-sec-297

After 6+ years, my journey at Grafana Labs is coming to a close. I feel grateful for the opportunities I had to grow, build and contribute. Grafana Labs will always hold a special place in my heart. ♥️ Now it's time to turn the page and start a new chapter. 🚀

An incident inspired me to contribute to an OSS security project. Here's a quick read on my journey: mostafa.dev/github-actio...

🚀 The project I've been maintaining for 6 years just hit 1 million downloads! 🎉 I'm also continuing my series on SAML SSO and the next article is coming soon. In case you missed the first one: mostafa.dev/saml-sso-in-... Repo: github.com/grafana/djan...

How do you know you're compromised? Read my newest article to see how we used canary tokens to detect an attack on our infrastructure. grafana.com/blog/2025/08...

The SAML SSO package I've been maintaining is about to hit 1 million downloads. 🎉 I saw this milestone as a great opportunity to share what I've learned and write a series of articles on SAML SSO. The first part is now live: mostafa.dev/saml-sso-in-...

I wrote a tiny article about detection of PII with Python: Feedback is welcome! 🙏 mostafa.dev/detecting-pi...

Published my first package to crates.io as part of the zizmor project. 🎉 Yamlpatch crate provides comment and format-preserving YAML patch operations using yamlpath, without the hassle of going through conversion to JSON and using JSONPath. crates.io/crates/yamlp...

Do you want to find out more about how @grafana.bsky.social secures its GitHub actions using Zizmor? Check out this post from James on my team : grafana.com/blog/2025/06... @yossarian.net

zizmor v1.10.0 is released! this is a *huge* new release: it exposes a new (experimental) auto-fix mode, more precise subspanning for fixtures, as well as a brand new pedantic audit (anonymous-definition) read the full notes here: docs.zizmor.sh/release-note...

thank you @grafana.bsky.social for being a logo-level sponsor of zizmor! (and also thank you @mosi.bsky.social and other folks at Grafana who've been sending me patches -- the next few releases are going to have a lot of really great new features)

Six years at Grafana Labs and counting! 🚀

Just shipped my first experimental, but already handy, feature to Zizmor, a static analyzer for GitHub Actions. The Rust compiler kept me honest the whole way! 🚀 github.com/zizmorcore/z...

We believe the tiny ad on page 28 of the Spring issue may have been missed by many. HACKER PERSPECTIVE SUBMISSIONS ARE OPEN AGAIN! Send us ~2500 words on what it means to be a hacker, get $500 if printed!

Last night I forked Air and merged most of the important PRs in the original repo into my fork and released a new Docker image that supports Go 1.24 and many other awesome features. Thanks to all the maintainers and contributors: github.com/mostafa/air hub.docker.com/mostafamorad...

GatewayD v0.10.1 is here! 🎉 This release introduces Raft-based state management for consistent and efficient coordination across GatewayD clusters to improves high availability, consistency, and scalability. github.com/gatewayd-io/...

It took long, but it's finally here: GatewayD's solution for detecting and preventing SQL injection attacks. 🙌🎉💉🎃

DM me if you like to contribute.

GatewayD v0.9.9 is here! 🎉 This version includes fixes, improvements and updates that lays the foundation for what's to come. github.com/gatewayd-io/...

This release fixes one of the nastiest bugs I’ve tackled. I had to use dlv, Wireshark, and other tools to track it down. It was tied directly to how the Postgres protocol works. But it’s finally resolved!

GatewayD v0.9.7 is released! 🎉 Tenants can now connect to multiple databases (vs. previous 1:1) and distribute the load among these databases. Random, round robin and weighted RR strategies with consistent hashing are supported, thanks to Sina Darbouy. github.com/gatewayd-io/...

Using Okta and Loki? Import Okta System logs into Loki with Grafana Alloy and our new Okta Logs Collector tool! grafana.com/blog/2024/08...

This. 👇

The GatewayD website keeps being updated and this is the latest version. gatewayd.io

Please test and provide feedback, as it is much appreciated! Also feel free to contribute to this project and others. 🙏

GatewayD v0.9.4 is out! 🎉 github.com/gatewayd-io/...

xk6-kafka is now available on arm64 architectures. 🎉 github.com/mostafa/xk6-...

Yay! 🙌🎉🚀

It is fairly straightforward to test GatewayD in action. 👇