stefanwaldvogel.com: Pré Carré, Castellan and the other projects — credits and sources Game design, code and artwork: Pré Carré and Castellan (all original; no third-party code or images). Licences (details in LICENSE.md): © 2026 Stefan Waldvogel. - Code: GNU General Public License, version 3 or (at your option) any later version (GPL-3.0-or-later): https://www.gnu.org/licenses/gpl-3.0.html — full text in LICENSE-CODE.txt. - Texts, pictures and reconstructions (the example data, captions and notes): Creative Commons Attribution-ShareAlike 4.0 International (CC BY-SA 4.0): https://creativecommons.org/licenses/by-sa/4.0/ - Fonts: SIL Open Font License 1.1 (licence texts in /fonts). Code: GNU GPL v3 or later · Texts, pictures and reconstructions: CC BY-SA 4.0 · Fonts: SIL OFL 1.1 Plans and models that visitors make with Castellan belong to them. Typefaces (self-hosted in /fonts, licence texts included): - IM Fell English and IM Fell English SC — Copyright (c) 2010 Igino Marini. SIL Open Font License 1.1. - Alegreya Sans — Copyright 2013 The Alegreya Sans Project Authors (Juan Pablo del Peral, Huerta Tipográfica). SIL Open Font License 1.1. - Inter (home page) — Copyright 2020 The Inter Project Authors. SIL Open Font License 1.1. - JetBrains Mono (home page, Lesson Ledger, Armour Proving Ground) — Copyright 2020 The JetBrains Mono Project Authors. SIL Open Font License 1.1. - Bricolage Grotesque and Figtree (Lesson Ledger) — Copyright 2022 their Project Authors. SIL Open Font License 1.1. - Saira Stencil One (Armour Proving Ground) — Copyright 2019 The Saira Stencil Project Authors. SIL Open Font License 1.1. - Barlow Condensed (Armour Proving Ground) — Copyright 2017 The Barlow Project Authors. SIL Open Font License 1.1. - Black Han Sans (Korean Metro, display headings only) — Copyright 2015 The Black Han Sans Project Authors (https://github.com/zesstype/Black-Han-Sans). SIL Open Font License 1.1. The font files were subset to Latin characters (Black Han Sans: Latin plus the few Hangul syllables of Korean Metro's headings) and converted to WOFF or WOFF2, as the licence permits. Other Korean text uses the fonts of your device. Cyber Hunting Guide - A compact successor to Stefan Waldvogel's Cybersecurity Job Hunting Guide (cyberhuntingguide.weebly.com, 2019–2021), written with the help of many contributors and editors. Texts CC BY-SA 4.0, code GPL-3.0 (as the page states; see LICENSE.md). The resource list links to outside sites, which belong to their owners; nothing is loaded from them. Job Hunt - A game about breaking into tech, in the spirit of the Cyber Hunting Guide. All rivals, names, employers and events are invented and generic; certification names are used only to describe study goals. Every chance, amount and applicant count is game balance that reflects the guide's view, not real statistics. Code GPL-3.0-or-later, texts CC BY-SA 4.0 (see LICENSE.md). Log Parser Builder (GROK · JSON · key=value · CSV · XML; formerly GROK Builder, at grok-builder.html) - A personal project, not an official Graylog or Elastic product. Logs are processed only in your browser. - The grok pattern library uses the usual pattern names (as in logstash-patterns-core, Apache-2.0), but the definitions are written from scratch for this tool; no pattern files were copied, so no Apache-2.0 material is included. - The ready-made formats use made-up sample data: RFC 5737 documentation addresses and example.com only. Graylog, Logstash, Elasticsearch, Elastic, Cisco ASA, CEF and LEEF are named only to describe compatible formats; they belong to their owners. - Its field-name suggestions come from the shared field mapping table (also used by the Graylog Toolkit, the Sigma Workbench, the Detection Desk and the Event Reference). - Schema: Graylog Illuminate field schema (Graylog Information Model), Illuminate 7.1 documentation (the breadcrumb says 7.0), fetched 2026-10-19 from https://go2docs.graylog.org/illuminate-current/schema/field_schema_entities/graylog_schema_entities.html and its 24 entity pages. Field names and types are taken from it (facts); the short field descriptions are our own wording. destination_port is not on the destination page fetched and was added by symmetry (marked). Keys the schema has no field for are kept under the product's own key and shown as "not in schema". - Vendor format starting points: generated by this tool from our own made-up sample lines, compared against the format types used by public parser collections. Detection toolkit: Sigma Workbench, Windows Event Reference, Graylog Toolkit (sigma-workbench.html, event-reference.html, graylog-toolkit.html, with sigma-worker.js and toolkit-worker.js) - Personal projects, not official Graylog, Elastic, Microsoft, Splunk or MITRE products. Data is processed only in your browser. - MITRE ATT&CK: the pages bundle a compact extract of MITRE ATT&CK Enterprise v20.0 (mitre/cti, enterprise-attack.json, commit 50be388e93819a5d20e71cbaaeccfda157abc846 of 2026-10-13; matrix modified 2026-07-31): technique ids, names, tactics, sub-technique parents and deprecated / revoked flags only, built by extras/attack/build_attack.py. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Licence (from https://attack.mitre.org/resources/legal-and-branding/terms-of-use/, read October 2026): "The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use ATT&CK® for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. MITRE's disclaimer applies: ATT&CK does not claim to list every possible technique, and covering techniques on a map does not guarantee full defensive coverage. https://attack.mitre.org/ - Sigma: the rule format is the open Sigma specification (https://github.com/SigmaHQ). No SigmaHQ rules are bundled — they are under the Detection Rule License (DRL 1.1) and are only linked. The six example rules are original (Stefan Waldvogel, CC BY-SA 4.0); their test events use RFC 5737 documentation addresses and example.com names only. base64offset and windash follow pySigma's documented behaviour; the converters are independent, best-effort code and suggest pySigma / sigma-cli. - Windows events: the descriptions in the Event Reference are my own summaries; no text was copied from Microsoft Learn or Sysinternals documentation, which is only linked (Sysmon page). Event ids, field names, logon types, status codes and encryption-type values are facts. Windows, Sysmon, Microsoft Defender, Microsoft Sentinel and KQL belong to Microsoft. - Graylog Toolkit: the list of pipeline functions and their parameters was taken (names only) from the Graylog documentation (archived function reference and the current function index); it may be incomplete. parse_date uses Joda-Time patterns (Graylog community forum, "Documentation of parse_date outdated links to Joda Time"). Graylog, Elasticsearch, Logstash, OpenSearch, Splunk, SPL, ES|QL and ECS are named to describe compatible formats; they belong to their owners. Detection toolkit, second set: Detection Desk, Analyst Kit, Coverage Planner (detection-desk.html, analyst-kit.html, coverage-planner.html, with desk-worker.js, analyst-worker.js and coverage-worker.js) and the Sysmon tab of the Event Reference - Personal projects, not official Graylog, Microsoft, Palantir, Splunk, Red Canary or MITRE products. Data is processed only in your browser; nothing is fetched from elsewhere. - MITRE ATT&CK detection data: the Coverage Planner also bundles, from the same MITRE ATT&CK Enterprise v20.0 file and commit as above, the detection model: detection strategies, analytics (platforms and log source references) and data components (names and log source names), built by extras/coverage/build_detect.py. The same MITRE copyright designation, licence and disclaimer as above apply. How "covered" and "partly covered" are counted, and the preset starting points, are my own choices, not MITRE's. - Atomic Red Team: the test planner bundles a trimmed index of Atomic Red Team (https://github.com/redcanaryco/atomic-red-team, atomics/Indexes/index.yaml at commit 388942adbd9641f4dfdcf079d7efe9a75ec0ac43 of 2026-09-05): technique id, test name, GUID, platforms, executor name, a one-line description and a link to the test page at that commit. No test commands are included. Its licence: The MIT License Copyright (c) 2018 Red Canary, Inc. Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. - Alerting and Detection Strategy (ADS): the Detection Desk's ADS builder is inspired by Palantir's ADS framework (https://github.com/palantir/alerting-detection-strategy-framework). Only the section names are used; no text was copied. - PEAK: the hunting notebook is inspired by the PEAK threat hunting framework (David Bianco, Splunk, "Introducing the PEAK Threat Hunting Framework", https://www.splunk.com/en_us/blog/security/peak-threat-hunting-framework.html). No text was copied. - Sysmon: event ids, names, filter tags, filter conditions, onmatch and RuleGroup groupRelation follow the Sysmon page on Microsoft Learn (Sysmon v15.22, page updated 2026-09-10; https://learn.microsoft.com/sysinternals/downloads/sysmon). The short texts are my own summaries; the key-field lists are a selection from practice, as the page does not list every field per event. - Sample data in these tools uses RFC 5737 / RFC 3849 documentation addresses, example.com / .org / .net and made-up hosts and users only. The decoder samples only print text or request example.com, and the decoder never runs anything. Korean Metro - A Korean vocabulary and dialogue trainer. The word lists are ordinary Korean vocabulary arranged by everyday themes; all dialogues, characters (Jisu, Daniel, Minho, Sophie, Eric, Tom), comprehension questions and notes are original practice material written for this trainer. The lesson colours are after the line colours of the Seoul subway. - Audio is spoken by your device's own speech synthesis; no recordings are included. - Seoul Missions (the metro game, website only): a simplified network of 60 stations on Lines 1, 2, 3, 4, 9 and AREX. Station order, the stations left out and the transfers follow the English Wikipedia articles "Seoul Subway Line 1", "Line 2", "Line 3", "Line 4", "Line 9" and "AREX" (CC BY-SA 4.0; facts only, checked October 2026). Line colours after the usual published values (itwiki "한국 철도 노선색"). The schematic map, the missions, dialogues and announcements are original; announcements are close approximations of the standard phrasing, not recordings; door sides are made up. Fares are approximate: the ₩1,550 adult card base fare since 28 June 2025 (Korea Times, 29 April 2025) for 10 km, plus ₩100 per 5 km; journey times are simulated. - Licence not yet assigned (pending Stefan Waldvogel's decision); see LICENSE.md. Terrains All landscapes and the ground of every example are freely modelled from published heights and descriptions (heights, positions and distances given in text sources such as Wikipedia, and general descriptions of the landforms), shaped with our own curves and noise and deliberately changed in detail. No map, hillshade, survey or aerial image was traced or sampled. Pré Carré landscapes - Freiburg im Breisgau: freely modelled from published heights and descriptions (the town on the plain at about 278 m, the Schlossberg 456 m, the Rosskopf 737 m, the Dreisam coming out of its valley from the east, the hills south of it and the Lorettoberg). - Besançon: freely modelled after the real site (the Doubs loop, the citadel on the neck, Chaudanne and Bregille). Castellan examples (all are reconstructions; sizes and dates marked "?" in the info cards are estimates) - Hochburg near Emmendingen: the works drawn after R. Brinkmann, Burgruine Hochburg (Bahlingen 2001), overview plan with legend; dates after the German Wikipedia article "Hochburg (Emmendingen)". The terrain, the brook, the lanes and the paths are freely modelled (a spur with the castle about 65 m above a valley to the east). - Burg Falkenstein and Ruine Bubenstein (Höllental): after J. Haller's plan of Burg Falkenstein (2011), the German Wikipedia articles "Burg Falkenstein (Höllental)", "Ruine Bubenstein", "Höllental (Schwarzwald)" and "Höllentalbahn (Schwarzwald)", and alleburgen.de. The valley, its streams, road, railway and paths are freely modelled from the castles' published coordinates and heights and the articles' descriptions. - Freiburg's Schlossberg: after the Schlossberg information board, an 18th-century French plan of Freiburg, the engraving "Leopoldoburgum oder Burghalden bey der Statt Freyburg im Breisgau" (c. 1670), schlossberg.freiburg.de, and the German Wikipedia articles "Schlossberg (Freiburg im Breisgau)", "Schlossbergturm" and "Bismarckturm (Freiburg im Breisgau)". The places of the works follow the information board; the hill and the walks are freely modelled from the published heights (town 278 m, Ludwigshöhe 376 m, Salzbüchsle about 430 m, summit 456 m). - Burg Boxberg: freely drawn after its castle plan of 1730 and the German Wikipedia article "Burg Boxberg". - Hohkönigsburg (Haut-Kœnigsbourg): from written descriptions only — German Wikipedia "Hohkönigsburg", the official press kit 2015 (Centre des monuments nationaux / Bas-Rhin), the visitors' plan, chateauxfortsalsace.com, burgen-web.de; compiled in the author's research notes. - Burg Landeck near Köndringen: from written descriptions — German Wikipedia "Burg Landeck (Baden)" and "Landeck (Teningen)", burgenwelt.org (plan with legend A–Y), alleburgen.de, burgenarchiv.de, quaeldich.de; compiled in the author's research notes. - Kastelburg above Waldkirch: from written descriptions — German Wikipedia "Kastelburg", EBIDAT (ebidat.de, plan after H. Wagner 2003), alleburgen.de, burgen-web.de; compiled in the author's research notes. - Neuf-Brisach: from written descriptions — German Wikipedia "Neuf-Brisach", the Mérimée record IA68005202, sites-vauban.org, tom-eck.de, lieux-insolites.fr; compiled in the author's research notes. - Hwaseong, Suwon (1794–96): from the Hwaseong Seongyeok Uigwe (1801, the royal record of the construction; public domain), the English Wikipedia article "Hwaseong Fortress" (CC BY-SA 4.0), the UNESCO World Heritage listing no. 817 (1997) and the Suwon Hwaseong Foundation (swcf.or.kr) for dates of the gates. Facts only; no text or drawings were copied. The ground (Paldalsan, the Suwoncheon) and the course of the wall are freely modelled to the published heights, length and area, not traced from a map; the places of the works along the wall are approximate. - The Heuneburg (Herbertingen-Hundersingen): from written descriptions — the German and English Wikipedia articles "Heuneburg" (CC BY-SA 4.0), the excavation reports of the Landesamt für Denkmalpflege Baden-Württemberg as summarised there, and M. Seefried, "Die Lehmziegelmauer der Heuneburg" (Lehm 2004, IG Lehm). Facts only; no plan or text was copied. The ground, the course of the walls and the places of houses, towers and mounds are freely modelled and marked as assumed; the forms of the Celtic walls, gates and houses follow general descriptions of Hallstatt and La Tène building. - The Saalburg (Roman fort near Bad Homburg, Upper German Limes, ORL 11): from written descriptions — the German Wikipedia article "Kastell Saalburg" and the English article "Saalburg" (CC BY-SA 4.0): the phases (earth forts of about AD 85/90, the numerus fort, the cohort fort of about 135, the stone fort of about 155/160 to about 260), the measures of the fort, its gates, wall and ditches, the watch posts Wp 3/68 and 3/69, the vicus, and the rebuilding of 1897–1907. Facts only; no plan or text was copied. The ground, the line of the Limes, the sizes of the inner buildings, the places of the earth forts, watchtowers and vicus houses are freely modelled and marked as assumed. - Ancient Roman architecture (style and library parts): the column orders and roofs after Vitruvius, De architectura (public domain); forts after Pseudo-Hyginus as summarised in the German Wikipedia article "Römisches Militärlager" and the English article "Castra"; the Limes, the Aurelian Walls, the Colosseum and the Pont du Gard after their Wikipedia articles (CC BY-SA 4.0). Facts only; proportions simplified; costs in denarii are an estimate (one man-day taken as one denarius, the day wage of Matthew 20:2). - The Ouvrage de Fermont (Maginot Line, fortified sector of the Crusnes): from written descriptions — the French Wikipedia article "Ouvrage de Fermont" and the English article "Ouvrage Fermont" (CC BY-SA 4.0), and the page "Fermont fortification" of cheminsdememoire.gouv.fr (French Ministry of the Armed Forces): the blocks and their armament, the entrances, the galleries, barracks, power station and magazine M1, the garrison, the attacks of 17 and 21 June 1940, the surrender of 27 June 1940, the Cold War and the museum. Facts only; no plan, photograph or text was copied. The ground and the places of the blocks, entrances, galleries and rooms are freely modelled (schematic) and marked so; where the sources differ, the notes say so. Bréhain's figures after the English Wikipedia article "Ouvrage Bréhain". - The 20th-century fortifications (styles and library parts): the CORF protection classes after wikimaginot.eu ("Protection", "La conception de la ligne Maginot"); turrets, cloches, obstacles and block layouts after the French and English Wikipedia articles "Ligne Maginot" / "Maginot Line", "Bloc de combat de la ligne Maginot", "GFM cloche" and "LG cloche"; the Westwall after the German Wikipedia articles "Westwall" and "Regelbau", west-wall.de and lexikon-der-wehrmacht.de (Regelbau 10); the Regelbau designations after the type list on valka.cz; flak towers after the German "Flakturm" and English "Flak tower" articles; air-raid bunkers after the German articles "Hochbunker", "Winkelturm" and "Zombeck-Turm" (all Wikipedia texts CC BY-SA 4.0). Facts only; proportions simplified and sizes not given in these sources estimated (the panel and notes say so). Costs in 1930s francs are calibrated on Fermont's 77 million francs, in Reichsmark on the Westwall's about 3.5 billion for over 18,000 bunkers: rough. The attackers of 1940 and 1944, crews per block type and the replay are game estimates and illustrations. - Motte and bailey, the empty hill, the blank meadow and the random landscapes: generic, made up. - Upper Danube valley (Donautal): freely modelled from general descriptions of the valley (a plateau cut by a deeply meandering river with limestone cliffs and narrow spurs): a generated meander, not a copy of the real one. Wikipedia texts are licensed under CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/); the facts taken from the articles named above (English Wikipedia for Hwaseong) were rewritten, not copied; authors are listed in each article's history. Historical names, places and events are used for illustration.