Skip to main content

One place for my cybersecurity projects, guides, articles, labs, tools, and research workflows

Cover image
Article Metadata

Ecosystem Fit​

This page mirrors the original Medium RSS article into the 1200km.com Docusaurus ecosystem. The article flow, images, screenshots, infographics, and technical blocks are preserved from the Medium feed.

From Scattered Research to a Structured Cybersecurity Knowledge Base​

Recently, I built something I had needed for a long time:​

Andrey Pautov - CTI, Detection Engineering & Security Research

At first I thought of it as a personal portfolio.

But after organizing the content, connecting the pages, grouping the topics, and building the navigation, I understood it had become something more: a cybersecurity knowledge base.

One structured place that connects my public work acrossMedium,GitHub, Docusaurus projects, guides, labs, tools, research notes, CTI workflows, detection engineering, malware analysis, OpenCTI, cloud security, Kubernetes, AI-assisted security research, and practical defensive work.

The goal is simple. Make my work easier to find, easier to understand, and easier to use.

Why I Built It​

For a long time, my work was spread across different platforms.

Articles were onMedium. Code, tools, and labs lived onGitHub. Larger structured projects became Docusaurus documentation sites — like theCTI Analyst Field Manual, a structured tradecraft handbook covering 10 modules, DRL 0–9 methodology, and ATT&CK-mapped detection backlog templates. Each platform served its purpose well.

But none of them alone showed the full picture.

The problem was not a lack of work. The problem was fragmentation.

A person could read one article and miss the related guide. Open a repository and miss the full documentation behind it. Find one project and miss the connected methodology. See one technical topic and not understand how it fits into the larger research direction.

So I built a central place. A single entry point. A map.

The important part is that the site is not a link collection.

A link collection is easy to build. A knowledge base is different.

A knowledge base needs structure. It needs categories, navigation, crosslinks, and context. It needs to show how separate pieces connect. It needs clear paths for different readers arriving from different directions —CTI, detection engineering, malware analysis, OpenCTI, cloud security, Kubernetes,AI-assisted offensive workflows, offensive-informed labs,classic penetration testing tools,guides, articles, research projects.

That was the real design goal.

A Cross-Platform Knowledge Layer​

The site connects work across multiple platforms without replacing any of them.

Medium remains the place for long-form articles and technical explanations. GitHub remains the place for code, tools, labs, and repositories. Docusaurus remains the place for structured field guides and larger research documentation — for example, theCustomer-Driven AI CTI Projectdocuments a full methodology for source-gated CTI-to-detection workflows, and theIsrael Government Threat Actors CTIsite covers actor research built from passive DNS, ASN reuse analysis, and certificate transparency.

The portfolio site acts as a navigation layer over the full ecosystem.

A reader can start from the main site, move into aguide, open a repository, read the related article, then return to the larger topic area. That crosslinking is what turns scattered content into a connected research base.

Why Structure Matters​

In cybersecurity, structure matters.

Without structure, even good work becomes hard to consume. A technical article can be useful, but in isolation it is easy to miss. A GitHub repository can be useful, but without context it may look like just another tool. A lab can be useful, but without explanation the defensive value may not be clear. A CTI workflow can be useful, but without links to examples and related work it becomes harder to apply.

Takethe CTI pageas a concrete example: it connects three Docusaurus documentation sites, ten GitHub repositories, and 35 articles across seven topic categories — actor research, CTI tradecraft, detection engineering, threat hunting, sector intelligence, and two full research series. Without a single page that maps all of that, a reader landing on any one piece would have no way to know the rest existed.

The same applies tothe labs: individual lab write-ups are useful, but the labs page shows them as a connected body of work — vulnerable environments, offensive simulations, detection coverage tests, cloud attack labs — each with its defensive rationale visible.

The knowledge base helps separate these things — showing the main areas, the supporting materials, the technical depth, and the connections between them.

What the Site Is Designed For​

I built the site for different types of readers.

For cybersecurity practitioners, it is a place to find practical material acrossCTI, detection engineering, malware analysis, OpenCTI, cloud, Kubernetes,tools, andlabs.

For recruiters and hiring managers, it gives a structured, verifiable overview of professional direction and depth of public work.

For CTI analysts,the CTI hubgives access to research workflows, tradecraft material, source discipline, detection-oriented thinking, and operational outputs — including two full published research series and three Docusaurus-hosted documentation projects.

For detection engineers, the site connects intelligence, adversary behavior, telemetry, hunting hypotheses, and detection logic. The connection between theCTI Analyst Field Manualand the detection backlog templates is one example of how that works in practice.

For learners, it provides a map of practical cybersecurity topics with links to deeper material acrossguides,labs, andAI-assisted offensive research.

For myself, it is also useful. It gives me one place to see what I have built, identify what is missing, and plan what should come next.

The Central Direction​

Although the site covers many topics, the direction behind it is consistent: cybersecurity research connected to practical defensive outcomes.

CTI should not stay only as reporting. It should connect to detection — as in theCustomer-Driven CTI-to-Detection Methodology, which applies a six-criteria source gate before any intelligence reaches the detection backlog. Detection should not stay only as rules. It should connect to telemetry, validation, and investigation — as inOperation DragonRx, a full APT41 simulation lab covering Sliver C2, credential dumping, and Wazuh + Zeek + Elastic detection coverage. Labs should help test assumptions and produce evidence. Tools should support real analyst work. AI should extend analytical capacity without replacing judgment or skipping verification.

This is the professional idea behind the site. Research, writing, tools, labs, documentation, and workflows that support one another.

What I Realized While Building It​

Only while building this site did I fully understand the scale of what I had produced.

And this was not built over many years. It came from a focused period of learning, building, testing, writing, publishing, fixing, and improving.

When the work was scattered, every piece felt separate. One article. One guide. One lab. One tool. One repository.

But once everything was organized in one place, the scale became visible. More importantly, the pattern became visible.

It was not random. It was a growing knowledge base built around practical cybersecurity research.

Why This Matters Beyond the Personal​

Cybersecurity knowledge is often fragmented by design. A person learns from a blog post, then from GitHub, then from vendor documentation, then from a lab, then from a report. That is normal — and unavoidable.

But when building professional knowledge, structure becomes important. You need to see relationships.

How does CTI connect to detection? How does detection connect to telemetry? How does malware analysis support threat intelligence? How does OpenCTI help organize knowledge? How do cloud and Kubernetes logs support investigations? How do labs validate defensive assumptions?

The site is my attempt to organize my own answers to these questions — not as a final truth, not as a perfect library, but as a practical and evolving knowledge base.

What Comes Next​

The site is not finished.

A knowledge base should keep evolving. The next steps are about improving structure, not just adding content:

  • Stronger crosslinks between related articles, guides, projects, and repositories
  • Clearer topic paths for different reader types
  • Maturity labels for tools and projects
  • Better separation between core work and supporting material
  • More practical examples and reviewer paths

The goal is not to publish more for its own sake. The goal is to make the existing work easier to navigate and use.

Final Thoughts​

This site became more than a personal portfolio.

It became a structured entry point into my public cybersecurity work. One place that connects articles, projects, guides, labs, tools, documentation, and research workflows. One place that bridgesMedium,GitHub, and Docusaurus under a single navigable structure. One place that shows the full picture instead of scattered pieces.

You can find it here:

Andrey Pautov - CTI, Detection Engineering & Security Research

Feedback, criticism, and suggestions are welcome.

Follow My Work​

I publish practical cybersecurity research, CTI workflows, detection engineering notes, malware analysis projects, OpenCTI work, cloud and Kubernetes security research, AI-assisted security tooling, labs, and technical guides.

Published · Last updated