Guilgo Blog

Notes from my daily work with technology.

KIO Snapshot: previous file versions in Dolphin on Btrfs

Previous Versions comes to KDE Plasma: Btrfs snapshots reachable from Dolphin without root

How to set up KIO Snapshot on Plasma 6 for previous file versions in Dolphin with Btrfs and Snapper: ACLs and /home snapshots on CachyOS/Arch.

Posted by David Guillermo on Friday, August 21, 2026

Prometheus and Alertmanager: automatic Kubernetes remediation with an allowlist

From alert to fix (with a brake): DiskPressure and Failed pods, a local gate, a short allowlist, and a single report

Prometheus and Alertmanager automatic remediation in Kubernetes with an allowlist: DiskPressure, Failed pods, one Telegram report, no cloud agents.

Posted by David Guillermo on Saturday, August 15, 2026

Integrating urlscan.io with Wazuh-lite for Automated Alert Enrichment

Automatically enrich AdGuard and parental control alerts with urlscan.io, dual Telegram notifications, and real reputation verdicts

Learn how to integrate urlscan.io with Wazuh-lite to enrich AdGuard alerts with URL reputation and threat intelligence while keeping your SIEM workflow.

Posted by David Guillermo on Saturday, July 25, 2026

How to Detect Compromised AUR Packages with Wazuh and Telegram on Arch Linux

Hourly checks against aur-malware-check, custom decoders, and level-12 alerts if a package from the atomic-lockfile attack is installed

Guide to detect compromised AUR packages on Arch Linux using Wazuh and Telegram: hourly aur-malware-check, custom decoders, and level-12 alerts.

Posted by David Guillermo on Sunday, June 14, 2026

Wazuh 5: a production survival guide

Verifiable criteria to go live without the stack overwhelming you

Verifiable criteria to take Wazuh 5 to production: predictable upgrades, signal vs noise, indexer performance, and a pilot with a clear stop rule.

Posted by David Guillermo on Wednesday, April 29, 2026

Build a proactive SOC in a homelab: Kubernetes, Docker, Wazuh, Trivy and Telegram

Low-noise periodic checks: broken pods, high Wazuh alerts, CVEs in exposed images and Telegram reports, with deduplication and clear severity policy

Guide: proactive homelab SOC with k3s, Wazuh, Trivy (CVEs on exposed Docker images) and Telegram. Cron, low noise, dedupe and actionable alerts.

Posted by David Guillermo on Sunday, April 26, 2026

avatar

Sysadmin, self-taught by curiosity.

FEATURED TAGS
adguard arch-linux docker homelab kubernetes linux microsoft monitoring parental-control powershell security siem sysadmin telegram wazuh wsus