---
title: "routetoroot (@routetoroot) | Hashnode"
description: "Cybersecurity walkthroughs, CTF writeups, and notes from the field. From zero to root. Read the latest articles by routetoroot on Hashnode."
url: "https://hashnode.com/@routetoroot"
---

@routetoroot

# routetoroot

@routetoroot · Los Angeles, California · Joined June 2026

Cybersecurity walkthroughs, CTF writeups, and notes from the field. From zero to root.

### [Lab 24: The Attack Ran. The Alerts Fired.](https://blog.routetoroot.io/lab-24-the-attack-ran-the-alerts-fired?utm_source=hashnode&utm_medium=feed)

I ran a live SSH brute force simulation against Kali Linux. Splunk fired 15 real-time alerts in under 2 seconds. Here's the full detection pipeline breakdown.

4 min read · [blog.routetoroot.io](https://blog.routetoroot.io/lab-24-the-attack-ran-the-alerts-fired?utm_source=hashnode&utm_medium=feed)

[Sep 29](https://hashnode.com/posts/lab-24-the-attack-ran-the-alerts-fired/6abb2d3c98db7171e65a261a)

### [Lab 23: Writing My First Splunk Detection Rule](https://blog.routetoroot.io/lab-23-writing-my-first-splunk-detection-rule?utm_source=hashnode&utm_medium=feed)

How I wrote an SPL query to detect SSH brute force activity, configured a real-time Splunk alert, and validated it against 75 live events.

4 min read · [blog.routetoroot.io](https://blog.routetoroot.io/lab-23-writing-my-first-splunk-detection-rule?utm_source=hashnode&utm_medium=feed)

[Sep 22](https://hashnode.com/posts/lab-23-writing-my-first-splunk-detection-rule/6ab1fff8beae88aed7ea27a3)

### [Lab 22: Same Logs, New SIEM — Setting Up Splunk From Scratch](https://blog.routetoroot.io/lab-22-same-logs-new-siem-setting-up-splunk-from-scratch?utm_source=hashnode&utm_medium=feed)

How I installed Splunk Enterprise 10.2.2 on Kali Linux, configured auth.log ingestion, and confirmed 76 SSH brute force events indexed.

4 min read · [blog.routetoroot.io](https://blog.routetoroot.io/lab-22-same-logs-new-siem-setting-up-splunk-from-scratch?utm_source=hashnode&utm_medium=feed)

[Sep 11](https://hashnode.com/posts/lab-22-same-logs-new-siem-setting-up-splunk-from-scratch/6aa34d8cd98c11b112aa136f)

### [Lab 21: I Finally Closed the Detection Gap](https://blog.routetoroot.io/lab-21-i-finally-closed-the-detection-gap?utm_source=hashnode&utm_medium=feed)

Eight labs. One misconfiguration. Here's how I traced, remediated, and validated the SSH detection gap that had been open since Lab 13.

4 min read · [blog.routetoroot.io](https://blog.routetoroot.io/lab-21-i-finally-closed-the-detection-gap?utm_source=hashnode&utm_medium=feed)

[Sep 5](https://hashnode.com/posts/lab-21-i-finally-closed-the-detection-gap/6a9b8c9bca800392808dd9f4)

### [Lab 13: The Attack Ran. The Alerts Didn't Fire.](https://blog.routetoroot.io/lab-13-the-attack-ran-the-alerts-didn-t-fire?utm_source=hashnode&utm_medium=feed)

I simulated an SSH brute force attack and confirmed 30 failed auth events in the logs. Zero alerts fired. Here's how I traced the detection gap.

5 min read · [blog.routetoroot.io](https://blog.routetoroot.io/lab-13-the-attack-ran-the-alerts-didn-t-fire?utm_source=hashnode&utm_medium=feed)

[Aug 31](https://hashnode.com/posts/lab-13-the-attack-ran-the-alerts-didn-t-fire/6a94daa4b50f84c69039b9b8)