:root{color-scheme:light;--hf-height:56px;--bg1:#fff;--bg2:#f0f0f0;--bg3:#e0e0e0;--fg1:#1a1a1a;--fg2:#666;--link:#2563eb;--accent:#2563eb;--border:#d1d5db;--btn-hover:#d1d5db;--syn-key:#0550ae;--syn-str:#116329;--syn-num:#953800;--syn-bool:#6639ba;--syn-punct:#666;--msg-param:#b91c1c;--highlight-bg:#fef08a;--highlight-fg:#1a1a1a;--tactic-reconnaissance:#6c3483;--tactic-initial_access:#c0392b;--tactic-execution:#d35400;--tactic-persistence:#b7950b;--tactic-privilege_escalation:#1e8449;--tactic-defense_evasion:#148f77;--tactic-credential_access:#2471a3;--tactic-discovery:#7d3c98;--tactic-lateral_movement:#c2185b;--tactic-collection:#00838f;--tactic-command_and_control:#5d4037;--tactic-exfiltration:#455a64;--tactic-impact:#c62828;--badge-bg:#374151;--badge-fg:#fff;--rel-sequence:#0369a1;--rel-shared-rules:#9ca3af;--rel-success-failure:#b91c1c;--rel-shared-schema:#2563eb;--rel-equivalent:#7c3aed}:root.theme-gruvbox-dark{color-scheme:dark;--bg1:#282828;--bg2:#1d2021;--bg3:#3c3836;--fg1:#ebdbb2;--fg2:#a89984;--link:#83a598;--accent:#fabd2f;--border:#504945;--btn-hover:#504945;--syn-key:#83a598;--syn-str:#b8bb26;--syn-num:#fe8019;--syn-bool:#d3869b;--syn-punct:#a89984;--msg-param:#fabd2f;--highlight-bg:#4a3a10;--highlight-fg:#fabd2f;--badge-bg:#504945;--badge-fg:#ebdbb2;--rel-sequence:#83a598;--rel-shared-rules:#665c54;--rel-success-failure:#fb4934;--rel-shared-schema:#83a598;--rel-equivalent:#d3869b}:root.theme-oxocarbon{color-scheme:dark;--bg1:#161616;--bg2:#262626;--bg3:#393939;--fg1:#dde1e6;--fg2:#a2a9b0;--link:#78a9ff;--accent:#be95ff;--border:#525252;--btn-hover:#393939;--syn-key:#78a9ff;--syn-str:#42be65;--syn-num:#ee5396;--syn-bool:#be95ff;--syn-punct:#a2a9b0;--msg-param:#08bdba;--highlight-bg:#2a1f47;--highlight-fg:#be95ff;--badge-bg:#525252;--badge-fg:#dde1e6;--rel-sequence:#78a9ff;--rel-shared-rules:#525252;--rel-success-failure:#ee5396;--rel-shared-schema:#78a9ff;--rel-equivalent:#be95ff}.chroma .lnlinks{outline:0;text-decoration:none;color:inherit}.chroma .lntd{vertical-align:top;padding:0;margin:0;border:0}.chroma .lntable{border-spacing:0;padding:0;margin:0;border:0}.chroma .hl{background-color:var(--bg2)}.chroma .lnt{white-space:pre;-webkit-user-select:none;user-select:none;margin-right:.4em;padding:0 .4em 0 .4em;color:#7f7f7f}.chroma .ln{white-space:pre;-webkit-user-select:none;user-select:none;margin-right:.4em;padding:0 .4em 0 .4em;color:#7f7f7f}.chroma .line{display:flex}.chroma .nt{color:var(--syn-key)}.chroma .s,.chroma .s2,.chroma .s1,.chroma .sa,.chroma .sb,.chroma .sc,.chroma .dl,.chroma .sd,.chroma .se,.chroma .sh,.chroma .si,.chroma .sx,.chroma .sr,.chroma .ss,.chroma .l-Scalar-Plain{color:var(--syn-str)}.chroma .mi,.chroma .mf,.chroma .mh,.chroma .il,.chroma .mb,.chroma .mo{color:var(--syn-num)}.chroma .kc{color:var(--syn-bool)}.chroma .p{color:var(--syn-punct)}.chroma .k{font-weight:bold}.chroma .kd{font-weight:bold}.chroma .kn{font-weight:bold}.chroma .kp{font-weight:bold}.chroma .kr{font-weight:bold}.chroma .kt{font-weight:bold}.chroma .nc{color:var(--syn-key);font-weight:bold}.chroma .no{color:var(--syn-key)}.chroma .nn{color:var(--syn-key)}.chroma .nb{color:var(--syn-bool)}.chroma .bp{color:var(--syn-bool)}.chroma .nv,.chroma .vc,.chroma .vg,.chroma .vi,.chroma .vm{color:var(--fg2)}.chroma .nf,.chroma .fm{color:var(--syn-key)}.chroma .c,.chroma .ch,.chroma .cm,.chroma .c1,.chroma .cs,.chroma .cp,.chroma .cpf{color:var(--fg2);font-style:italic}.chroma .ow{font-weight:bold}html{scrollbar-gutter:stable}@media(prefers-reduced-motion:no-preference){html,.post-body,.blog-index{scroll-behavior:smooth}}body{display:flex;min-height:100dvh;flex-direction:column;margin:0;background-color:var(--bg1);color:var(--fg1);font-family:sans-serif;line-height:1.5;-webkit-text-size-adjust:none;text-size-adjust:none}header,footer,thead,pre,code{background-color:var(--bg2)}kbd{display:inline-block;padding:2px 6px;font-family:monospace;font-size:.875em;line-height:1.2;color:var(--fg1);background-color:var(--bg2);border:1px solid var(--border);border-radius:3px;box-shadow:inset 0 -1px 0 var(--border)}main{width:100%;max-width:1200px;margin:0 auto;padding-inline:2em;padding-block:0;box-sizing:border-box}main>h1:first-child{font-size:1.15rem;margin-top:-1.5em;margin-bottom:0}article{margin-top:2em}article:not(:last-of-type){padding-bottom:2em;border-bottom:solid 1px var(--fg2)}.metadata{margin:1em 0}.tags{list-style:none;display:inline-flex;gap:.5em;margin:0;padding:0}.tags a{color:var(--fg2);text-decoration:none}:is(h1,h2,h3,h4,h5,h6) .anchor{visibility:hidden}:is(h1,h2,h3,h4,h5,h6):hover .anchor{visibility:visible}p,li{text-align:left}a{color:var(--link);text-decoration:none}a:hover{text-decoration:underline}pre code{padding:0}code{padding:.2em .3em;overflow-wrap:break-word;word-break:break-word}a{overflow-wrap:break-word;word-break:break-word}table{border-collapse:collapse;width:auto;max-width:100%;word-wrap:break-word;overflow-wrap:break-word}td,th{border:solid 1px var(--border)}td,th{padding:.4em .75em}th{font-size:.8rem}pre{padding:1em}pre,.katex{overflow:auto}figure{margin:0}img{width:100%}figcaption{margin-top:1em;color:var(--fg2);text-align:center}.stat-item:not(:last-child)::after{content:",";margin-right:.3em}.table-scroll-wrap{overflow-x:auto;-webkit-overflow-scrolling:touch}.post-authors{display:flex;align-items:center;gap:.4rem;flex-wrap:wrap}.post-author-link{text-decoration:none}.post-author-name{font-weight:600}.author-icons{display:flex;gap:.3rem;align-items:center}.author-social{display:inline-flex;align-items:center;text-decoration:none}.author-social svg{width:18px;height:18px;fill:var(--fg2)}.author-profile{padding:2em 1em;margin-top:2em;border-top:1px solid var(--border);display:flex;gap:1.5em;align-items:flex-start}.author-header{display:flex;gap:1rem;align-items:center}.author-header-content{display:flex;flex-direction:column;gap:.3em;align-items:flex-start}.author-title-row{display:flex;gap:.5em;align-items:center}.author-full-bio{margin-top:.5em}.author-posts{margin-top:1em}.author-row{display:flex;gap:1.5em;align-items:center;margin-bottom:1em}.author-name{font-weight:600;width:10em}.author-name a{text-decoration:none;color:var(--fg1)}.author-links-right{display:flex;gap:.5rem;align-items:center;margin-left:auto}.blog-heading{margin:-1.5rem 0 0 0}.posts-showcase{display:flex;gap:1.5em;flex-wrap:wrap}.post-showcase{flex:1 1 300px}.post-showcase:first-child{flex:1 1 100%;margin-bottom:.5em}.post-showcase-title{font-size:1.15rem}.post-meta{font-size:.85rem;color:var(--fg2)}.post-excerpt{position:relative;overflow:hidden;max-height:6em}.excerpt-fade{position:absolute;bottom:0;left:0;right:0;height:2.5em;background:linear-gradient(transparent,var(--bg1));pointer-events:none}.read-more a{font-size:.85rem;color:var(--link)}.read-more a:hover{text-decoration:underline}.home-sidebar{position:fixed;right:2em;top:calc(var(--hf-height) + 1em);width:14em}.sidebar-section{margin-bottom:1.25rem}.sidebar-title{font-size:.8rem;text-transform:uppercase;color:var(--fg2)}.sidebar-list{list-style:none;padding:0;margin:.35em 0 0;display:flex;flex-direction:column;gap:.2em}.sidebar-list a{color:var(--fg1);font-size:.85rem}.sidebar-list a:hover{color:var(--link)}header{background-color:var(--bg2);height:var(--hf-height);min-height:var(--hf-height);display:flex;align-items:center;position:relative;box-sizing:border-box;padding:0;border-bottom:1px solid var(--border);flex-shrink:0}.navbar{width:100%;height:100%;display:flex;align-items:center;padding:0 .75rem;box-sizing:border-box;position:relative;background:inherit;font-family:sans-serif}.site-logo{display:inline-block;width:40px;height:40px;color:var(--fg1);margin-right:.5rem}.site-logo .icon{display:block}.site-brand{position:absolute;left:50%;transform:translateX(-50%);display:flex;align-items:center;gap:.5rem;text-decoration:none;height:var(--hf-height)}.header-title{color:var(--fg1);text-decoration:none;font-weight:600;font-size:1rem}.header-actions{display:flex;align-items:center;gap:2rem;margin-left:auto}.header-action-link{color:var(--fg1);text-decoration:none;font-size:.8125rem;font-weight:600;white-space:nowrap;display:flex;align-items:center}.header-action-link:hover,.header-action-link.active{color:var(--link);text-decoration:none}.btn-icon{background:0;border:0;color:var(--fg1);cursor:pointer;padding:0;display:flex;align-items:center}.btn-icon:hover{color:var(--link)}.help-btn{font-size:.6875rem;font-weight:600;font-family:inherit;white-space:nowrap}.icon{display:inline-block;background-color:currentColor;-webkit-mask-size:contain;mask-size:contain;-webkit-mask-repeat:no-repeat;mask-repeat:no-repeat;-webkit-mask-position:center;mask-position:center}.icon-sun{width:14px;height:14px;-webkit-mask-image:url("data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2024%2024'%20fill='none'%20stroke='black'%20stroke-width='2'%20stroke-linecap='round'%20stroke-linejoin='round'%3E%3Ccircle%20cx='12'%20cy='12'%20r='5'/%3E%3Cline%20x1='12'%20y1='1'%20x2='12'%20y2='3'/%3E%3Cline%20x1='12'%20y1='21'%20x2='12'%20y2='23'/%3E%3Cline%20x1='4.22'%20y1='4.22'%20x2='5.64'%20y2='5.64'/%3E%3Cline%20x1='18.36'%20y1='18.36'%20x2='19.78'%20y2='19.78'/%3E%3Cline%20x1='1'%20y1='12'%20x2='3'%20y2='12'/%3E%3Cline%20x1='21'%20y1='12'%20x2='23'%20y2='12'/%3E%3Cline%20x1='4.22'%20y1='19.78'%20x2='5.64'%20y2='18.36'/%3E%3Cline%20x1='18.36'%20y1='5.64'%20x2='19.78'%20y2='4.22'/%3E%3C/svg%3E");mask-image:url("data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2024%2024'%20fill='none'%20stroke='black'%20stroke-width='2'%20stroke-linecap='round'%20stroke-linejoin='round'%3E%3Ccircle%20cx='12'%20cy='12'%20r='5'/%3E%3Cline%20x1='12'%20y1='1'%20x2='12'%20y2='3'/%3E%3Cline%20x1='12'%20y1='21'%20x2='12'%20y2='23'/%3E%3Cline%20x1='4.22'%20y1='4.22'%20x2='5.64'%20y2='5.64'/%3E%3Cline%20x1='18.36'%20y1='18.36'%20x2='19.78'%20y2='19.78'/%3E%3Cline%20x1='1'%20y1='12'%20x2='3'%20y2='12'/%3E%3Cline%20x1='21'%20y1='12'%20x2='23'%20y2='12'/%3E%3Cline%20x1='4.22'%20y1='19.78'%20x2='5.64'%20y2='18.36'/%3E%3Cline%20x1='18.36'%20y1='5.64'%20x2='19.78'%20y2='4.22'/%3E%3C/svg%3E")}.icon-menu{width:16px;height:16px;-webkit-mask-image:url("data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2024%2024'%20fill='none'%20stroke='black'%20stroke-width='2'%20stroke-linecap='round'%3E%3Cline%20x1='3'%20y1='6'%20x2='21'%20y2='6'/%3E%3Cline%20x1='3'%20y1='12'%20x2='21'%20y2='12'/%3E%3Cline%20x1='3'%20y1='18'%20x2='21'%20y2='18'/%3E%3C/svg%3E");mask-image:url("data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2024%2024'%20fill='none'%20stroke='black'%20stroke-width='2'%20stroke-linecap='round'%3E%3Cline%20x1='3'%20y1='6'%20x2='21'%20y2='6'/%3E%3Cline%20x1='3'%20y1='12'%20x2='21'%20y2='12'/%3E%3Cline%20x1='3'%20y1='18'%20x2='21'%20y2='18'/%3E%3C/svg%3E")}.icon-shield{width:40px;height:40px;-webkit-mask-image:url("data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2064%2064'%3E%3Cpath%20d='M32%204l24%208V28c0%2016-12%2027-24%2032C20%2055%208%2044%208%2028V12z'%20fill='none'%20stroke='black'%20stroke-width='3'/%3E%3Cpath%20d='M32%2018l4%2012%208%204-8%204-4%2012-4-12-8-4%208-4z'%20fill='black'/%3E%3C/svg%3E");mask-image:url("data:image/svg+xml,%3Csvg%20xmlns='http://www.w3.org/2000/svg'%20viewBox='0%200%2064%2064'%3E%3Cpath%20d='M32%204l24%208V28c0%2016-12%2027-24%2032C20%2055%208%2044%208%2028V12z'%20fill='none'%20stroke='black'%20stroke-width='3'/%3E%3Cpath%20d='M32%2018l4%2012%208%204-8%204-4%2012-4-12-8-4%208-4z'%20fill='black'/%3E%3C/svg%3E")}.nav-check-hidden{position:absolute;opacity:0;pointer-events:none}.nav-toggle{display:none}.nav-links{display:contents}.theme-cycle-btn{padding:.3rem;justify-content:center;border-radius:4px}@media(max-width:600px){header{height:auto;min-height:auto;padding:.5rem 0}.navbar{min-height:auto;padding:0 .625rem}.site-brand{position:absolute;left:50%;transform:translateX(-50%)}.site-logo{width:34px;height:34px}.site-logo .icon-shield{width:34px;height:34px}.header-title{font-size:1rem}.header-actions{flex-direction:row;align-items:center;gap:1rem}.help-btn{display:none}.nav-toggle{display:flex}.nav-toggle .icon-menu{width:20px;height:20px}.nav-links{display:none;position:absolute;top:calc(100% + 4px);right:0;background:var(--bg2);border:1px solid var(--border);border-radius:4px;min-width:140px;box-shadow:0 4px 12px rgba(0,0,0,0.3);z-index:1001;padding:.25rem 0;flex-direction:column}#nav-check:checked ~ .nav-links{display:flex}#nav-check:focus-visible ~ .nav-toggle{outline:2px solid var(--link);outline-offset:2px}.nav-links .header-action-link{font-size:.8125rem;padding:.5rem 1rem}.nav-links .header-action-link:hover{background:var(--btn-hover)}}.help-overlay{border:0;padding:0;background:transparent;overflow:visible;inset:0;margin:auto}.help-overlay:popover-open{display:flex;align-items:center;justify-content:center}.help-overlay::backdrop{background:rgba(0,0,0,0.5)}.help-panel{position:relative;background:var(--bg2);border:1px solid var(--border);border-radius:6px;box-shadow:0 8px 24px rgba(0,0,0,0.4);max-width:90%;width:auto;padding:1.5em 2em;max-height:85vh;overflow-y:auto}.help-panel h2{margin:0 0 .75em;font-size:1rem}.help-panel dl{display:grid;grid-template-columns:auto 1fr;gap:.4em 1.25em;align-items:baseline;margin:0}.help-panel dt{text-align:right;white-space:nowrap}.help-panel dd{margin:0;font-size:.875rem;color:var(--fg2)}.help-nav-link{margin:1em 0 0;font-size:.85rem;color:var(--fg2)}.hint-label{position:absolute;top:0;left:100%;z-index:500;background:var(--accent);color:var(--bg1);font:bold 11px/1 monospace;text-transform:uppercase;padding:2px 4px;border-radius:3px;white-space:nowrap;pointer-events:none;transform:translate(2px,-100%);box-shadow:0 1px 3px rgba(0,0,0,.35)}.hint-label--hidden{display:none}@media(max-width:820px){.home-sidebar{position:static;width:auto;margin-top:2rem}.event-meta{gap:.3em .75rem}}@media(max-width:768px){.search-pagination{flex-wrap:wrap}}@media(max-width:600px){main,.footer-content{padding-left:1em;padding-right:1em}.blog-heading{margin:-1.25rem 0 0 0}.event-catalog-summary{display:none}.event-provider-table td{padding:.5em;font-size:.875rem}.event-provider-table th{padding:.5em;font-size:.65rem}.event-provider-table td:first-child{word-break:break-word}.event-toc-table .col-channel{display:none}.event-toc-table td,.event-toc-table th{padding:.35em .5em;font-size:.8rem}.event-fields-table td,.event-fields-table th{padding:.5em;font-size:.875rem}.search-results-table thead{display:none}.search-results-table tr{display:block}.search-results-table td{display:block;padding:0 .75em;border:0;font-size:.85rem}.search-group-header td{display:block;padding:.6em .75em .25em}.filter-chip{padding:.3em .5em;font-size:.7rem}td,th{padding:.5em}pre{padding:.5em}.search-card{padding:.5em}.search-card-primary{font-size:.8rem}.search-card-context{font-size:.75rem;padding-left:.5em}}@media(max-width:480px){main,.footer-content{padding-left:.4em;padding-right:.4em}.event-meta{flex-direction:column;gap:.25em}}:root{--header-bg:var(--bg2);--header-border:var(--border);--sidebar-bg:var(--bg2);--sidebar-hover:var(--bg3);--sidebar-highlight:var(--accent);--content-bg:var(--bg1);--detail-bg:var(--bg2);--tile-border:var(--border);--text:var(--fg1);--text-dim:var(--fg2);--text-bright:var(--fg1);--accent-light:var(--link);--kql-keyword:#00f;--kql-purple:#af00db;--kql-string:#a31515;--kql-func:#795e26;--kql-variable:#001080;--kql-number:#098658;--kql-comment:#008000;--kql-qop:#267f99;--green:#16a34a;--yellow:#ca8a04;--gruvbox-fg:var(--fg1);--gruvbox-green:#15803d;--gruvbox-aqua:#0d9488;--code-bg:#f5f5f7;--row-alt:var(--bg2);--tag-bg:#dbeafe;--tag-hover:#bfdbfe;--font-ui:'Segoe UI',-apple-system,system-ui,sans-serif;--font-mono:'Cascadia Code','Consolas','Fira Code',monospace;--icon-rail-width:52px;--tree-panel-width:293px;--detail-panel-width:221px;--post-header-height:42px;--tab-bar-height:36px}:root.theme-gruvbox-dark{--kql-keyword:#569cd6;--kql-purple:#c586c0;--kql-string:#ce9178;--kql-func:#dcdcaa;--kql-variable:#9cdcfe;--kql-number:#b5cea8;--kql-comment:#6a9955;--kql-qop:#4ec9b0;--green:#89d185;--yellow:#e8ab53;--gruvbox-green:#b8bb26;--gruvbox-aqua:#8ec07c;--code-bg:#1d2021;--status-pub-bg:#1a3a1a;--status-pub-border:#2d5a2d;--status-draft-bg:#3a2a1a;--status-draft-border:#5a4a2d;--tag-bg:#0e3a5c;--tag-hover:#124a72}:root.theme-oxocarbon{--kql-keyword:#ff7eb6;--kql-purple:#ee5396;--kql-string:#3ddbd9;--kql-func:#be95ff;--kql-variable:#82cfff;--kql-number:#42be65;--kql-comment:#697077;--kql-qop:#33b1ff;--green:#42be65;--yellow:#ffe97b;--gruvbox-green:#42be65;--gruvbox-aqua:#3ddbd9;--code-bg:#0d0d0d;--status-pub-bg:#0d331a;--status-pub-border:#198038;--status-draft-bg:#332400;--status-draft-border:#8e6a00;--tag-bg:#1c1c3e;--tag-hover:#2a2a5a}*,*::before,*::after{margin:0;padding:0;box-sizing:border-box}html{height:100%;overflow-y:scroll;scrollbar-gutter:stable}body{height:100%;background:var(--content-bg);color:var(--text);font-family:var(--font-ui);font-size:13px;line-height:1.4}a{color:inherit;text-decoration:none}.shell{display:flex;flex-direction:column;height:100vh;width:100%;overflow:hidden}.shell__main{display:flex;flex:1;overflow:hidden}.post-header{display:flex;align-items:center;gap:10px;padding:8px 16px;background:var(--header-bg);border-bottom:1px solid var(--header-border);flex-shrink:0}.post-header__back{color:var(--text-dim);cursor:pointer;font-size:13px}.post-header__back:hover{color:var(--text)}.post-header__divider{width:1px;height:20px;background:var(--header-border)}.post-header__title{color:var(--text-bright);font-size:15px;font-weight:600}.post-header__right{margin-left:auto;display:flex;gap:12px;align-items:center}.icon-rail{width:var(--icon-rail-width);background:var(--header-bg);border-right:1px solid var(--header-border);display:flex;flex-direction:column;align-items:center;padding-top:6px;flex-shrink:0}.icon-rail__item{width:48px;height:48px;display:flex;align-items:center;justify-content:center;color:var(--text-dim);border-left:3px solid transparent;cursor:pointer}.icon-rail__item:hover{color:var(--text)}.icon-rail__item--active{color:var(--accent);border-left-color:var(--accent)}.icon-rail__item svg{width:32px;height:32px}.icon-rail__restore-tree{display:none;width:48px;height:48px;align-items:center;justify-content:center;color:var(--text-dim);cursor:pointer}.icon-rail__restore-tree:hover{color:var(--text)}#tree-toggle:checked ~ .shell__main .icon-rail__restore-tree{display:flex}.tree-panel{width:var(--tree-panel-width);background:var(--sidebar-bg);border-right:1px solid var(--header-border);display:flex;flex-direction:column;overflow:hidden;flex-shrink:0}.tree-panel__header{display:flex;align-items:center;justify-content:space-between;padding:8px 4px 6px 5px;border-bottom:1px solid var(--header-border);font-weight:600;font-size:13px;color:var(--text-dim);letter-spacing:.5px;text-transform:uppercase}.tree-panel__favorites{padding:5px 10px;display:flex;align-items:center;gap:5px;color:var(--text-dim);font-size:14px;font-weight:600;border-bottom:1px solid var(--header-border)}.tree-panel__body{flex:1;overflow-y:auto;padding-top:2px}.tree-panel__body details>summary{list-style:none}.tree-panel__body details>summary::-webkit-details-marker{display:none}.tree-item{display:flex;align-items:center;gap:5px;padding:2.5px 8px;color:var(--text);font-size:15px;line-height:26px;cursor:pointer;white-space:nowrap;overflow:hidden}.tree-item:hover{background:var(--sidebar-hover)}.tree-item--selected{background:var(--sidebar-highlight)}.tree-item--selected:hover{background:var(--sidebar-highlight)}.tree-item__chevron{width:16px;display:flex;align-items:center;justify-content:center;flex-shrink:0;font-size:18px;color:var(--text-dim)}.tree-item>svg{width:14px;height:14px;flex-shrink:0}.tree-item__label{overflow:hidden;text-overflow:ellipsis}.tree-item[data-depth="0"]{padding-left:5px}.tree-item[data-depth="1"]{padding-left:24px}.tree-item[data-depth="2"]{padding-left:38px}.tree-item[data-depth="3"]{padding-left:52px}.content-split{flex:1;display:flex;overflow:hidden}.post-body{flex:1;min-width:0;overflow-x:hidden;overflow-y:auto;scrollbar-gutter:stable;padding:28px 40px;background:var(--content-bg);word-break:break-word;overflow-wrap:break-word}.post-body img{max-width:100%;height:auto}.post-body h1{font-size:28px;font-weight:700;color:var(--gruvbox-fg);margin:0 0 20px;line-height:1.3}.post-body h2{font-size:20px;font-weight:600;color:var(--gruvbox-fg);margin:32px 0 14px;padding-bottom:8px;border-bottom:1px solid var(--tile-border)}.post-body h3{font-size:16px;font-weight:600;color:var(--gruvbox-fg);margin:24px 0 10px}.post-body h4{font-size:14px;font-weight:600;color:var(--gruvbox-fg);margin:20px 0 8px}.post-body p{line-height:1.7;font-size:14px;color:var(--text);margin:0 0 16px}.post-body ul,.post-body ol{margin:0 0 16px;padding-left:24px;color:var(--text);line-height:1.8;font-size:14px}.post-body a{color:var(--accent-light)}.post-body a:hover{text-decoration:underline}.post-body code{background:var(--code-bg);padding:2px 6px;border-radius:3px;font-size:13px;color:var(--kql-string);font-family:var(--font-mono)}.post-body pre{position:relative;background:var(--code-bg);padding:16px;border-radius:4px;overflow-x:auto;margin:0 0 16px;border:1px solid var(--tile-border);width:fit-content;max-width:100%}.post-body pre code{background:0;padding:0;border-radius:0;font-size:13px;color:var(--text)}.post-body pre.chroma span{font-weight:normal;font-style:normal}.code-copy-btn{position:absolute;top:6px;right:6px;background:var(--sidebar-bg);border:1px solid var(--tile-border);border-radius:3px;padding:3px 8px;font-size:11px;color:var(--text-dim);cursor:pointer;opacity:0;transition:opacity .15s;font-family:var(--font-ui)}.post-body pre:hover .code-copy-btn,.table-scroll-wrap:hover .code-copy-btn{opacity:1}.code-copy-btn:hover{color:var(--text);border-color:var(--text-dim)}@media(hover:none){.code-copy-btn{opacity:1}}.copy-flash{position:relative}.copy-flash::after{content:'Copied!';position:absolute;inset:0;display:flex;align-items:center;justify-content:center;background:var(--bg2);color:var(--green);border:1px solid var(--green);border-radius:inherit;font-size:inherit;animation:copy-flash 1.5s ease-out forwards;pointer-events:none}@keyframes copy-flash{0%,85%{opacity:1}100%{opacity:0}}@media(prefers-reduced-motion:reduce){@keyframes copy-flash{0%,100%{opacity:1}}}.post-body blockquote{background:var(--code-bg);border-left:3px solid var(--accent);padding:14px 18px;margin:0 0 24px;border-radius:0 4px 4px 0;line-height:1.7;font-size:14px}.post-body blockquote p{margin:0}.table-scroll-wrap{overflow-x:auto;margin-bottom:16px;position:relative;width:fit-content;max-width:100%}.table-scroll-wrap table{margin-bottom:0}.post-body table{margin-bottom:16px;border:1px solid var(--tile-border);border-radius:4px;border-collapse:collapse;overflow-x:auto;font-size:13px}.post-body thead{background:var(--sidebar-bg)}.post-body th{padding:6px 14px;font-size:12px;font-weight:600;color:var(--text-dim);text-align:left;border-bottom:1px solid var(--tile-border);white-space:nowrap}.post-body td{padding:5px 14px;border-bottom:1px solid var(--tile-border);white-space:nowrap}.post-body tr:nth-child(even){background:var(--content-bg)}.post-body tr:nth-child(odd){background:var(--row-alt)}.post-body thead tr{background:var(--sidebar-bg)}.detail-panel{width:var(--detail-panel-width);flex-shrink:0;background:var(--detail-bg);border-left:1px solid var(--header-border);overflow-y:auto}.detail-panel__section{padding:14px 18px;border-bottom:1px solid var(--tile-border)}.detail-panel__section:last-child{border-bottom:0}.detail-panel__heading{font-size:13px;font-weight:600;color:var(--text-dim);text-transform:uppercase;letter-spacing:.5px;margin-bottom:10px}.detail-kv{display:grid;grid-template-columns:auto 1fr;gap:8px;font-size:14px}.detail-kv__label{color:var(--text-dim)}.detail-kv__value{color:var(--text);text-align:right}.detail-author{display:flex;flex-wrap:wrap;align-items:center;gap:4px 8px}.detail-author__name{color:var(--gruvbox-aqua);font-size:14px;font-weight:500}.detail-action-link{display:block;color:var(--accent-light);font-size:13px;margin-bottom:6px;cursor:pointer}.detail-action-link:hover{text-decoration:underline}.detail-action-link:target{background:var(--accent-light);color:var(--bg1);border-radius:3px;padding:2px 6px;text-decoration:none}.detail-tags{display:flex;gap:6px;flex-wrap:wrap}.detail-tag{background:var(--tag-bg);color:var(--accent-light);padding:3px 8px;border-radius:3px;font-size:12px;font-family:var(--font-mono);text-decoration:none}a.detail-tag:hover{background:var(--tag-hover)}.detail-toc{display:flex;flex-direction:column;gap:6px}.detail-toc a{color:var(--accent-light);font-size:14px;cursor:pointer}.detail-toc a:hover{text-decoration:underline}.detail-toc #TableOfContents{display:flex;flex-direction:column;gap:6px}.detail-toc #TableOfContents ul{list-style:none;margin:0;padding:0;display:flex;flex-direction:column;gap:6px}.detail-toc #TableOfContents li{margin:0;padding:0}.detail-toc #TableOfContents a{color:var(--accent-light);font-size:14px}.detail-toc #TableOfContents a:hover{text-decoration:underline}.share-wrapper{position:relative}.share-trigger{background:0;border:0;padding:0;font-family:inherit;color:var(--text-dim);cursor:pointer;font-size:12px;user-select:none}.share-trigger:hover{color:var(--text)}.share-dropdown{position:absolute;top:24px;right:0;z-index:100;background:var(--sidebar-bg);border:1px solid var(--header-border);border-radius:4px;min-width:160px;padding:4px 0;box-shadow:0 4px 16px rgba(0,0,0,0.4);display:none}.share-wrapper:focus-within .share-dropdown{display:block}.share-dropdown__item{display:flex;align-items:center;gap:8px;padding:7px 14px;cursor:pointer;font-size:13px;color:var(--text-bright)}.share-dropdown__item:hover{background:var(--sidebar-hover)}.icon--table{color:var(--accent)}.icon--db{color:var(--yellow)}.icon--cluster{color:var(--accent)}.icon--lab{color:var(--gruvbox-aqua)}.blog-index{flex:1;overflow-y:auto;scrollbar-gutter:stable;padding:28px 40px;background:var(--content-bg)}.blog-index__table{width:100%;border:1px solid var(--tile-border);border-radius:4px;border-collapse:separate;border-spacing:0;overflow:hidden;font-size:15px}.blog-index__table thead{background:var(--sidebar-bg)}.blog-index__table th{padding:8px 8px;font-size:14px;font-weight:600;color:var(--text-dim);text-align:left;border-bottom:1px solid var(--tile-border)}.blog-index__table th+th,.blog-index__table td+td{border-left:1px solid var(--tile-border)}.blog-index__table th:first-child,.blog-index__table td:first-child{padding-left:14px}.blog-index__table th:last-child,.blog-index__table td:last-child{padding-right:14px}.blog-index__table td{padding:8px 8px;border-bottom:1px solid var(--tile-border);white-space:nowrap}.blog-index__table tbody tr:last-child td{border-bottom:0}.blog-index__table tr:nth-child(even){background:var(--content-bg)}.blog-index__table tr:nth-child(odd){background:var(--row-alt)}.blog-index__table thead tr{background:var(--sidebar-bg)}.blog-index__table tbody tr{cursor:pointer}.blog-index__table tbody tr:hover{background:var(--sidebar-hover)}.blog-index__table td.blog-index__title-cell{color:var(--gruvbox-green);font-weight:500;width:50%;white-space:normal}.blog-index__author-cell{color:var(--gruvbox-aqua)}.labs-cards{display:flex;flex-direction:column;gap:10px}.labs-card{display:block;padding:.6em .75em;border:1px solid var(--tile-border);border-radius:4px;text-decoration:none;color:inherit;transition:border-color .15s,background .15s}.labs-card:hover{border-color:var(--gruvbox-green);background:var(--row-alt)}.labs-card__top-line{display:flex;align-items:baseline;gap:.5em}.labs-card__title{margin:0;font-size:15px;font-weight:600;color:var(--gruvbox-green);line-height:1.3;flex:1}.labs-card__header{display:flex;gap:.5em;font-size:13px;white-space:nowrap;flex-shrink:0}.labs-card__date{color:var(--text-dim)}.labs-card__author{color:var(--gruvbox-aqua);font-weight:500}.labs-card__desc{margin:.3em 0 0 0;font-size:13px;color:var(--text-dim);line-height:1.5}.labs-card__tags{display:flex;flex-wrap:wrap;gap:6px;margin-top:auto}.labs-card__tag{font-size:11px;padding:2px 8px;border-radius:3px;font-weight:500;white-space:nowrap}.labs-card__tag--tactic{background:var(--status-draft-bg);color:var(--yellow);border:1px solid var(--status-draft-border)}.labs-card__tag--technique{background:var(--status-pub-bg);color:var(--green);border:1px solid var(--status-pub-border)}.blog-index__table tbody tr{position:relative}.blog-index__section-heading{font-size:16px;font-weight:600;color:var(--gruvbox-fg);margin:24px 0 10px}.blog-index__section-heading:first-of-type{margin-top:0}.blog-index__row-link{color:inherit;text-decoration:none}.blog-index__row-link::after{content:'';position:absolute;inset:0}.blog-authors__entry{margin-bottom:24px;padding-bottom:24px;border-bottom:1px solid var(--tile-border)}.blog-authors__entry:last-child{border-bottom:0}.blog-authors__header{display:flex;align-items:flex-start;gap:12px}.blog-authors__name{font-size:18px;font-weight:600;color:var(--gruvbox-aqua);display:flex;align-items:center;gap:8px;margin:0}.blog-authors__profile{color:var(--text-dim);font-size:13px;margin:2px 0 0}.blog-authors__email{display:block;color:var(--accent-light);font-size:13px;margin:2px 0 0}.blog-authors__bio{margin-top:10px;font-size:14px;line-height:1.6;color:var(--text)}.blog-authors__linkedin{color:var(--text-dim);display:inline-flex;align-items:center}.blog-authors__linkedin:hover{color:#0a66c2}.post-header__detail-toggle{background:0;border:1px solid var(--header-border);border-radius:3px;padding:4px 6px;color:var(--text-dim);cursor:pointer;display:flex;align-items:center;justify-content:center;line-height:1}.post-header__detail-toggle:hover{color:var(--text);border-color:var(--text-dim)}.tree-panel__collapse{background:0;border:0;color:var(--text-dim);cursor:pointer;font-size:12px;padding:0 2px;line-height:1}.tree-panel__collapse:hover{color:var(--text)}.panel-toggle{position:absolute;opacity:0;pointer-events:none}#detail-toggle:checked ~ .shell__main .detail-panel{display:none}#tree-toggle:checked ~ .shell__main .tree-panel{display:none}#tree-toggle:checked ~ .shell__main .tree-panel__resize{display:none}.tree-collapse__expand{display:none}#tree-toggle:checked ~ .shell__main .tree-collapse__collapse{display:none}#tree-toggle:checked ~ .shell__main .tree-collapse__expand{display:inline}.tree-panel__resize{width:4px;cursor:col-resize;background:transparent;flex-shrink:0;position:relative}.tree-panel__resize:hover{background:var(--accent);opacity:.5}#authors{position:absolute;visibility:hidden}#blog-authors-section{display:none}#authors:target ~ #blog-authors-section{display:block}#authors:target ~ #blog-posts-section{display:none}.shell:has(#authors:target)>.post-header{display:none}.shell:has(#authors:target) #icon-rail-authors{color:var(--accent);border-left-color:var(--accent)}.shell:has(#authors:target) .icon-rail__item[href="/blog/"]{color:var(--text);border-left-color:transparent}.blog-filter-section{display:none}.blog-filter-section:target{display:block}.blog-filter-section:target ~ #blog-authors-section{display:none}.blog-filter-section:target ~ #blog-posts-section{display:none}.blog-filter-section__heading{font-size:18px;font-weight:600;color:var(--gruvbox-fg);margin:0 0 16px}@media(max-width:768px){.icon-rail,.tree-panel,.tree-panel__resize,.detail-panel{display:none}html,body{height:auto;overflow:auto}.shell{height:auto;overflow:visible}.shell__main{overflow:visible}.content-split{overflow:visible;max-width:100vw}.post-body img{max-width:100%;height:auto}.post-body pre{max-width:calc(100vw - 40px)}.post-body{padding:20px 20px;overflow-x:hidden;word-break:break-word;overflow-wrap:break-word}.post-body code{word-break:break-all;-webkit-hyphens:none;hyphens:none}.blog-index{padding:20px 20px}.post-body table{display:block;overflow-x:auto}.post-header__detail-toggle,.share-wrapper{display:none}.blog-index__table th,.blog-index__table td{padding:6px 6px}.blog-index__table th:first-child,.blog-index__table td:first-child{padding-left:10px}.blog-index__table th:last-child,.blog-index__table td:last-child{padding-right:10px}.blog-index__title-cell{white-space:normal}.blog-index__row-link::after{display:none}.blog-index__table tbody tr{position:static}.post-header{padding:8px 10px;gap:8px}.post-header__divider{display:none}.post-header__title{font-size:13px}.share-dropdown{right:0;left:auto}}@media(max-width:480px){.post-body{padding:16px 14px}.blog-index{padding:16px 14px}.post-body h1{font-size:22px}.post-body h2{font-size:18px}.post-body pre{padding:12px;font-size:12px;max-width:calc(100vw - 28px)}.post-body blockquote{padding:10px 14px}.post-header__back{font-size:12px}.blog-index__table{font-size:13px}.blog-index__table th,.blog-index__table td{padding:6px 4px}.blog-index__table th:first-child,.blog-index__table td:first-child{padding-left:8px}.blog-index__table th:last-child,.blog-index__table td:last-child{padding-right:8px}}.mermaid{text-align:center;margin:1.5em 0}