Research & Engineering

Four platforms, built to make an argument

These are working systems, not prototypes — each one self-hostable, each one built on open standards rather than around them, and each one shipped with its non-goals and limitations written down. They exist because I would rather demonstrate a position than assert it, and because the fastest way to understand a problem properly is still to build the thing.

The figures below come from reviews of the running code rather than from the project documentation, which in a few places had drifted.

JuniLake

Thesis: You can build a credible, open, vendor-neutral detection lakehouse without an enterprise budget — if you embed the standards and reserve your original engineering for the production machinery around them. It is a direct answer to three problems: telemetry trapped behind proprietary APIs and per-gigabyte pricing, detection drift between live rules and historical hunts, and the operational opacity of not being able to see or move your own data.
What it does: A security data lake that detects at both ends of the data's life: the moment an event arrives, via a Rust Sigma engine at stream time, and at any point afterwards over historical data through retro-hunt replay. Windows endpoint telemetry is ingested, stored as Parquet on S3-compatible object storage under a DuckLake / Iceberg-compatible catalog, evaluated against the Sigma community standard, and delivered as alerts to a sibling SOC product. Retro-hunt replays historical Parquet through the same engine as live detection, so there is no second rule-translation path and no drift.
Scale & posture: Seventeen always-on containers in one Docker Compose project, split across three bridge networks for blast-radius control. 2,776 Sigma rules. Hot, warm and cold tiering against the generic S3 API rather than any vendor lifecycle feature, so the lake is portable by construction. Runs on a single 32 GB machine; scale-out paths are documented rather than prematurely built. Every dependency permissively or copyleft licensed; the project itself is AGPL-3.0. Thirty-eight architecture decision records.
Stack: Rust · Parquet · DuckLake / Iceberg · DuckDB · PostgreSQL · NATS JetStream · Fluent Bit · MongoDB · Sigma · Docker Compose

JuniBas

Thesis: Most BAS tooling stops at the detection of the gap — a simulation runs, a red cell appears, and the platform considers the job done. In a real CTEM program the gap is the beginning of the work. The value is in what happens after the finding: who owns it, what the treatment plan is, whether it was actually fixed, and whether the re-test proves it.
What it does: A program-management spine for running a CTEM, BAS and adversarial-exposure-validation practice end to end. It unifies three sources of findings — automated BAS engagements, manual red-team engagements, and imported results — under one lifecycle, so a human-run red team is the same engagement record as a simulator run and nothing downstream needs to care which produced the finding. Remediation is a first-class, audited workflow: an eight-state task lifecycle, separate re-test mini-engagements, status cascades that propagate finding state, escalation gates, SLA clocks measured in business hours, and a per-entity audit trail that joins into a single cross-entity timeline.
Scale & posture: Roughly 58,000 lines of Python; 18 model files across 50-plus mapped tables; 24 route modules; 44 services; 33 Alembic migrations; approximately 850 automated tests across 76 files. Four BAS platform integrations behind one vendor-agnostic adapter, including a bidirectional integration that launches a scenario from inside an engagement, syncs results back, and imports the gaps as findings. Eight seeded roles, each with a scoped view. Substantially conforms to OWASP ASVS v5.0.0 Level 2 for the implemented feature set — self-assessed, not independently audited, and documented as such. AGPL-3.0.
Stack: Python · Flask · PostgreSQL · Redis · Alembic · gunicorn · MITRE ATT&CK · OpenAEV / Picus / Cymulate / SafeBreach adapters · Docker Compose

JuniSoc

Thesis: A SOC's case management should be boring, fast and self-hosted. Server-rendered HTML with htmx does the job without a front-end framework, and Postgres full-text search does the job without Elasticsearch — which removes an entire class of operational burden from a small team.
What it does: Alert triage with a live queue, dedup counts, classification workflow and automatic correlation suggestions; escalation of one or many alerts into coded incidents with a status workflow, alert merging and searchable analyst notes; a structured customer advisory builder on top of per-customer Word templates, delivered as secure portal links, attachments or inline email with optional password-protected PDFs; a second, fully isolated authentication realm where customers read and acknowledge those advisories; ad-hoc and scheduled threat hunts whose findings escalate into incidents; and an ATT&CK catalogue browser with a theoretical-versus-observed coverage heat map driven by analyst-confirmed techniques.
Scale & posture: Role-based access control built on JSONB permission documents with six system roles; TOTP and passkey MFA in both authentication realms; analyst workload and session tracking; a full audit log; KPI dashboards refreshing over htmx without WebSockets. Ships in three modes — standalone, demo with a synthetic alert feed, and connected, consuming real alerts from a JuniLake deployment under a versioned alert contract. Includes a pluggable local-LLM drafting seam that is disabled by default and makes no network calls.
Stack: Python · Flask · htmx · Alpine · PostgreSQL (incl. FTS) · MongoDB · Redis · RQ · Caddy · Docker Compose

JuniFleet

Thesis: Endpoint visibility should belong to the operator. Fleet and osquery already solve the hard part; what a DFIR-minded operator needs on top is evidence collection, and the discipline to add it without quietly taking anything that is not yours to take.
What it does: A private internal fork of Fleet, the open-source osquery-based device management and visibility platform, baselined on upstream v4.83.0. My additions, all written independently for this fork: customer groups, a CIS benchmark page driven by self-authored policies, a vulnerability dashboard, TOTP multi-factor authentication, file carving and forensic collection, and installer generation.
Scale & posture: Explicitly not distributed, not sold, not offered as a service, and not made publicly available — it is deployed solely for my own infrastructure monitoring. It always runs the free tier: no licence key is ever configured, so every premium code path stays dormant. The upstream enterprise directory could not be deleted outright because MIT-licensed core code imports several of its Go packages unconditionally, so only the subset required to compile is retained and everything else was removed; the reasoning and the exact retained paths are documented in the fork's licensing notice. I include it here because how a fork handles someone else's licence is worth showing.
Stack: Go · osquery · MySQL · Redis · React · Docker

Talks

Submitted — under review

These have been submitted to the conferences named and have not been accepted. They are listed because the arguments are the ones the platforms above were built to make, not as a record of appearances.

2026-07 CODE BLUE 2026 · submitted If AI Can Write the Code, What's Left to Build? Ask for the abstract
2025-08 TenguCon 2 · submitted Reclaiming Cyber Sovereignty — Why Governments and Sensitive Industries Must Build Their Own Security Data Lakes Ask for the abstract
2025-06 CODE BLUE 2025 · submitted Breaking Enterprise Security — A Systematic Purple Team Evaluation of Modern Defense Controls Ask for the abstract

Contact

Happy to walk through any of these — architecture, decision records, or the parts that did not work.

Get in touch Email: julien@infrayo.com