Danny On The Air dannyota

Hey, I'm Danny 👋

Security engineer who writes the tools I need and open-sources them when they might help someone else. Mostly Go, C, and Python.

CLIs that turn live SIEM and EDR platforms into code you can git diff:

secops — operate Google SecOps (Chronicle SIEM + Siemplify SOAR) as code — pull detection rules, parsers, dashboards, and SOAR playbooks into files, review the diff, push back
s1ctl — operate SentinelOne Singularity as code — agents, policies, exclusions, threat lifecycle, remote shell
splunkctl — operate Splunk Enterprise SIEM as code — SPL search, detection-as-code YAML, alerts, dashboards, indexes

All three ship with machine-readable command trees and embedded agent guides — built for both humans and AI agents.

Evidence-only RAG + MCP servers that hand your AI exact legal provisions — no hallucination, no paraphrasing:

banhmi — Vietnamese banking & fintech regulation (State Bank of Vietnam, Ministry of Justice)
laksa — Malaysian banking & fintech regulation (Bank Negara Malaysia, Securities Commission)

Small, focused clients for security and cloud platforms — each one go get-able straight off danny.vn/…:

Package	Platform
`s1`	SentinelOne Singularity — agents, policies, threats, remote shell
`secops`	Google SecOps — Chronicle SIEM + Siemplify SOAR
`fortigate`	FortiGate firewall REST API
`fortimgr`	FortiManager FlatUI API
`nessus`	Tenable Nessus scanner (read-only)
`vngcloud`	VNG Cloud IAM
`kaggle`	Kaggle API — kernels, datasets, token introspection

offthebook — memory-only Windows PE execution via SMB-over-QUIC SEC_IMAGE loading, with position-independent shellcode in pure C (MSVC + Clang)

byway — transparent per-app VPN bypass on Linux using cgroup v2 + nftables + policy routing
flowcvcli — drive a FlowCV résumé from the command line or Python — content, design, templates, avatar, publish & PDF export

More at danny.vn.