badsignals

Hello

Thu, 27 Aug 2026 00:00:00 +0000

This is where I’ll write about detection engineering, log pipelines, and whatever broke at 2am and turned out to be interesting.

More soon.

about

Mon, 01 Jan 0001 00:00:00 +0000

Hi,

My name is Miguel Cardoso, born in 22-09-2026, connected to the internet ever since I can remember.

I speak Portuguese, English, Spanish, and I’m currently learning German. With computers, I mainly speak Python, and I’m learning the basics of the beautiful C language.

I’m completely self-taught.

I work as a CSIRT engineer at a managed security provider, mostly on detection engineering and log pipelines across a multi-tenant SOC.

## about this blog

This site is where I write things down so I stop re-deriving them. Most posts start as something that broke at 2am and ended up being interesting.

contact

Mon, 01 Jan 0001 00:00:00 +0000

Nothing here is my employer’s position.

now

Mon, 01 Jan 0001 00:00:00 +0000

Last updated 2026-08-27.

Working detection engineering and log pipeline problems across a multi-tenant SOC — mostly FortiGate, rsyslog, and Splunk right now, with Entra ID sign-in and consent-grant detections in the mix.

Outside of that: getting more comfortable in C, and picking up German.

posts
uses

projects

Mon, 01 Jan 0001 00:00:00 +0000

Nothing published here yet — most of what I build lives inside client environments and can’t be shared as-is.

When something’s generalisable enough to release (a Sigma rule, a parsing config, a small tool), it’ll show up here first.

github

uses

Mon, 01 Jan 0001 00:00:00 +0000

A short list of what shows up most in the posts here.

## detection & log pipelines

FortiGate syslog, normalised before it hits the index
rsyslog as the collector/forwarder layer
Splunk for search and detections
Microsoft Entra ID sign-in and consent-grant logs via KQL

## languages

Python, day to day
C, still learning