CyberAar Research https://cyberaar.io/en/research/ Research and field notes from the CyberAar team: detection engineering, hardening, and running an open source SOC platform in production. en Sat, 22 Aug 2026 17:00:00 GMT Our failover had never worked, and every dashboard was green https://cyberaar.io/en/research/three-ways-a-control-can-lie/ https://cyberaar.io/en/research/three-ways-a-control-can-lie/ Sat, 22 Aug 2026 17:00:00 GMT A VRRP pair that never moved its floating IP for two months, and the two other controls we found lying the same day. high-availability keepalived detection-engineering monitoring incident CIS and Docker contradict each other, so decide in writing https://cyberaar.io/en/research/cis-hardening-versus-docker/ https://cyberaar.io/en/research/cis-hardening-versus-docker/ Thu, 20 Aug 2026 22:00:00 GMT CIS says disable IP forwarding. Docker depends on it. Applying the control breaks the platform; skipping it quietly makes the compliance report lie. cis compliance docker hardening grc fail2ban locked us out of the whole estate, and it was right https://cyberaar.io/en/research/fail2ban-locked-us-out/ https://cyberaar.io/en/research/fail2ban-locked-us-out/ Thu, 20 Aug 2026 21:00:00 GMT An SSH agent holding several keys exhausts MaxAuthTries before offering the right one. Run in parallel, every node bans you at the same moment. ssh fail2ban hardening ansible Our NAT gateway triggered a port scan alert in our own SOC https://cyberaar.io/en/research/nat-gateway-false-positive-scan/ https://cyberaar.io/en/research/nat-gateway-false-positive-scan/ Thu, 20 Aug 2026 18:00:00 GMT Docker quietly takes ownership of the FORWARD chain. After a reboot, our private nodes produced a slow port scan alert that was entirely correct. docker iptables nat detection-engineering false-positive Escaping is not enough: the second decode inside an onclick https://cyberaar.io/en/research/escaping-is-not-enough-onclick/ https://cyberaar.io/en/research/escaping-is-not-enough-onclick/ Thu, 20 Aug 2026 16:00:00 GMT A correctly escaped value becomes executable again inside an onclick attribute. Three defects found in our back office, and why the CSP hid one of them. xss csp application-security javascript We audited our own website the way we audit a client's https://cyberaar.io/en/research/auditing-our-own-website/ https://cyberaar.io/en/research/auditing-our-own-website/ Thu, 20 Aug 2026 00:00:00 GMT Four findings on cyberaar.io, including TLS 1.0 still accepted at the edge and a playbook that reported success while doing nothing. Commands included. tls caa cloudflare security-txt ansible