// ironcat

Aaron Rosenmund

Security Research · Detection Engineering

I break, build, and defend systems — then teach the pattern.

scroll

detection engineering/self-hosted infrastructure/threat intelligence/security research/teaching

About

I work at the seam between offense and defense: building the tooling, running the infrastructure, and turning what I learn into detections and teaching. Everything on this page — the observability stack, the threat feed, the detector — I designed, built, and run myself under the ironcat handle.

Selected work

Sentinel

Observability / SIEM

Central telemetry + threat pipeline. Vector ships SSH-auth and edge access logs into Postgres; a Go API scores, clusters, and rolls them up; a Next.js HUD makes it legible across every VM.

VectorGoPostgresNext.js

visit →

ECHO

Open threat intelligence

Free, CC0 threat intel derived from real attacks on production infrastructure — IP reputation, per-tag blocklists, attacker wordlists, and operator profiles. No signup, now with a token-gated v1 API.

Next.jsGoPostgres

visit →

DFD

Deepfake detector

Metadata-provenance deepfake detection for video, image, and audio — transparent, corpus-derived rules instead of a black-box model, with a public developer API.

FastAPINext.jsPostgres

visit →

Contact

Open to security research collaborations, speaking, and interesting detection-engineering problems. The fastest way to reach me:

GitHub@arosenmund →LinkedInin/aaronrosenmund →X@ironcat →Pluralsightauthor profile →Emailaaron.rosenmund@ondefend.com →