@routetoroot

routetoroot

@routetorootLos Angeles, CaliforniaJoined June 2026

Cybersecurity walkthroughs, CTF writeups, and notes from the field. From zero to root.

About

Self-taught cybersecurity practitioner documenting the path from zero to root. SOC analyst, CTF player, detection engineer. 29 hands-on labs and counting.

Available for

Nothing here yet.

routetoroot's blogs

RouteToRootblog.routetoroot.io11 posts

Lab 24: The Attack Ran. The Alerts Fired.

In Lab 13, I ran a brute force attack and got zero alerts. In Lab 24, I ran the same attack in Splunk. 15 alerts fired in under 2 seconds. That's the difference between a detection gap and a detection

Sep 29 · 4 min readblog.routetoroot.io

Lab 23: Writing My First Splunk Detection Rule

Lab 22 got Splunk running. 180 events indexed. 76 SSH brute force events confirmed in the index. The pipeline was alive. But a SIEM with no detection rules is still just a search engine. Lab 23 is whe

Sep 22 · 4 min readblog.routetoroot.io

Lab 22: Same Logs, New SIEM — Setting Up Splunk From Scratch

Lab 21 closed the detection gap in Elastic. 31 alerts fired. End-to-end detection confirmed. The Elastic SIEM phase of the portfolio was complete. So naturally, I installed a second SIEM. Lab 22 is th

Sep 11 · 4 min readblog.routetoroot.io

Lab 21: I Finally Closed the Detection Gap

Eight labs ago, I ran a brute force attack against my own system and watched zero alerts fire. I knew the attack happened. The logs confirmed it. But the SIEM never saw it — because the logs that matt

Sep 5 · 4 min readblog.routetoroot.io

Lab 13: The Attack Ran. The Alerts Didn't Fire.

In Lab 12, I built the detection rules. Three prebuilt Elastic rules targeting Linux attack techniques. One custom KQL rule for SSH authentication failures. The pipeline was configured, the rules were

Aug 31 · 5 min readblog.routetoroot.io

routetoroot

About

Available for

routetoroot's blogs

Lab 24: The Attack Ran. The Alerts Fired.

Lab 23: Writing My First Splunk Detection Rule

Lab 22: Same Logs, New SIEM — Setting Up Splunk From Scratch

Lab 21: I Finally Closed the Detection Gap

Lab 13: The Attack Ran. The Alerts Didn't Fire.

Search Hashnode

routetoroot

About

Available for

routetoroot's blogs

Lab 24: The Attack Ran. The Alerts Fired.

Lab 23: Writing My First Splunk Detection Rule

Lab 22: Same Logs, New SIEM — Setting Up Splunk From Scratch

Lab 21: I Finally Closed the Detection Gap

Lab 13: The Attack Ran. The Alerts Didn't Fire.