claude-code-cyber-defense-writeups

claude-code-cyber-defense-writeups

Write-ups from working through AI Cyber Defense Ops, a course on using the Claude ecosystem (Claude Code, Claude Desktop, MCP) for blue-team security work.

These are learning notes, not polished tutorials. I've left the wrong turns, the dead ends, and the questions in, because working out what broke and why was most of the learning.

Write-ups

Building my first tool with Claude Code A Sysmon event parser, built as a first pass through the Claude Code workflow. Context files, sample data before code, plan mode, saving state, and a namespace trap that would have quietly returned nothing.

Wrapping a security CLI with MCP An MCP server around Hayabusa for EVTX analysis, connected to both Claude Code and Claude Desktop. Covers MCP architecture and the wrapper pattern, plus four things that broke: a schema too loose to constrain anything, a parser that reported clean scans with zero findings, a config split the course predates, and a Windows packaging quirk that hides the Desktop config file somewhere nothing documents.

Learning how to build a detection knowledge base with MCP resources Resources are the read-only half of MCP: data at a URI that Claude reads, rather than an action it calls. Four of them exposing Sigma rules and ATT&CK technique mappings, plus two tools that read those resources to report coverage across a tactic and suggest rules for the gaps.

Covers the four things that define a resource, designing a URI scheme so the routes cannot collide, why resources do not appear in the first place you would look for them, and what changes once a tool starts reading the same data a resource exposes. Every number the finished thing reports rests on one assumption, and it turned out not to hold three separate ways.

Building guardrails for a detection workflow with hooks Four Claude Code hooks around a detection workflow: validating Sigma-style rules after writes, blocking sensitive paths before tool use, checking prerequisites at session start, and notifying on completion. Covers exit-code and output contracts, Windows path and shell behavior, bypasses in a file_path-based guard, the different coverage of hooks and permission rules, and several cases where Claude's explanation of its own behavior did not survive testing or documentation checks.

Notes

Screenshots live in images/. Everything here was built on Windows, so paths and shell commands are PowerShell unless stated otherwise.