u/athanielx

What books genuinely changed how you think about cybersecurity, rather than just teaching another tool or technique?

A few examples of the kind of books I mean:

• Security Chaos Engineering - Kelly Shortridge: resilience, complex systems, testing security assumptions, and learning from failure.
• Cybersecurity First Principles - Rick Howard: building security strategy around reducing material risk rather than accumulating controls and tools.
• The Smartest Person in the Room - Christian Espinosa: why technical expertise alone isn't enough; communication, leadership, and business understanding matter.
• Applied Network Security Monitoring - Chris Sanders et al.: approaching network security monitoring as a structured process of collection, detection, and analysis rather than simply generating alerts.
• Offensive Countermeasures - John Strand & Paul Asadoorian: active defense, deception, honeypots, and making the environment hostile to attackers.

Books outside cybersecurity - systems thinking, SRE, risk, economics, failure analysis - count too.

Hi there,

We have encountered an issue with one of our users. For an unknown reason, the user's device is not registered in Entra ID. However, I can see the device in Company Portal with the status: "This device is enrolled with another device management provider."

I normally see this status for all newly enrolled devices, but after about 5 minutes, the device is registered in Entra ID, integrated with Intune, and the status changes to "This device is enrolled with Jamf Compliance."

To troubleshoot, I have already:

• Re-enrolled the user.
• Removed and reinstalled Company Portal.

We are deploying the Platform SSO extension, and so far only one user has experienced this issue. However, I expect we may see more cases like this in the future.

Could you please advise how to troubleshoot this issue? Is there a way to force or trigger the device registration in Entra ID for this user?

As a free SIEM, I use Wazuh, but with my own little custom modifications, because the out-of-the-box version does not fit all of my use cases. I have also tried Security Onion and the free version of ELK.

For Windows systems, I collect basic logs and Sysmon events.

For Linux systems, I use Falco, which also covers containers. I also tried Tetragon, but decided to move forward with Sysmon for Linux, since Tetragon required more time to properly configure and operationalize. Auditd is another option, but I have never really liked it for analyzing Linux system logs.

For network monitoring, I use Zeek and RITA. In practice, however, I do not use them very often, because production teams do not always have the capacity to process large volumes of traffic or maintain this type of setup.

We've been using FortiGate for a little over a year now. I integrated it with our SIEM and spent a significant amount of time tuning security alerts to reduce noise and make them more actionable.

The problem is that I'm still struggling to understand the real value of FortiGate IPS alerts.

Around 80% of our IPS events are just these two signatures:

• TCP.Overlapping.Fragments
• TCP.Out.Of.Range.Timestamp

The rest is mostly things like:

• HTML.Code.Obfuscators
• TCP.Inconsistent.Retransmission
• IPv4.Invalid.Datagram.Size
• NBSS.Invalid.Fragment
• HTTP.Null.Session
• HTTP.Suspicious.Headers.With.Special.Characters
• Gstreamer.QuickTime.File.Parsing.Multiple.Buffer.Overflow
• MS.Windows.MsMpEng.Type.Confusion.Code.Execution
• NBSS.Invalid.PDU.Size
• DNS.Invalid.Opcode
• MS.SQL.Server.SQLXML.Buffer.Overflow

After investigating these over time, virtually all of them have turned out to be false positives or completely benign traffic.

I also pay attention to Application Control (including port) events, but that's another source of massive alert volume, and it's difficult to identify anything truly interesting among all the noise.

So I'm curious how others are handling this.

• Which FortiGate IPS alerts do you actually consider high-value?
• Which signatures or categories do you disable or tune?
• How do you configure your IPS/Application Control policies to keep alerts useful without drowning in false positives?
• Are there any FortiGate alerts that have consistently helped you detect real incidents?

I'm specifically asking about FortiGate IPS/Application Control, not NDR solutions. I'd really like to understand how other teams are getting actionable security value out of FortiGate alerts.

My budgie started treatment for ornithosis/psittacosis. After the medications, he began vomiting and his droppings became very bright/acid yellow.

We stopped the antibiotic and took him to the vet today. A vet gave him 3 injections for vomiting and some vitamins, but it is now evening and he is still vomiting after eating. He is sleepy, keeps closing his eyes, and does not want to drink Ringer’s solution on his own.

Could this be a reaction to the antibiotic or other meds?

Our threatment:

• Unidox Solutab 100 mg — tablet dissolved in water, given 0.06 ml twice daily every 12 hours.
• Nystatin tablet — mixed with water and Duphalac, given 0.08 ml twice daily.
• Ukrliv suspension — given 0.07 ml twice daily.
• Heptral 500 mg/5 ml — prepared from powder + solvent, divided into insulin syringes and frozen, given thawed 0.2 ml twice daily.
• Engystol + Echinacea + Engystol + Berberis — mixed together in one syringe, given 0.12–0.15 ml once daily.

We had just started the treatment for ornithosis/psittacosis.

We gave all the prescribed medications for one full day. Then, at the beginning of the next day, after the third dose/third administration, he started vomiting/regurgitating. Since then, he has been vomiting after eating, has very bright yellow droppings, is sleepy, and keeps closing his eyes

The avian vet told us that he has never seen a bird react like this to these medications before. He thinks it's possible that our budgie may have been poisoned by something else, rather than the medications.

I'm honestly not sure what to do anymore because he doesn't seem to be getting any better. He is still very sleepy, sits quietly in one corner with his eyes closed most of the time, and every time he eats, he starts vomiting shortly afterward.

I don't know what to do...

How do professionals apply these AIs to penetration testing?
For instance, I possess numerous authorized company targets for AI-assisted pentesting, yet built-in protections respond, “this isn’t legitimate, and I won’t assist.”
Codex allows circumvention through prompts like “this is a CTFplease verify,” while Claude resists even with that approach.

What alternative AIs might work?

I have been dealing with recurring discomfort on the right side near my testicle for about two years. I am having difficulty identifying the exact location. Sometimes it feels below or behind the right testicle, but at other times it feels above it, closer to the pubic bone or inguinal area.
The sensation is usually dragging, burning, or warm rather than sharp. It comes and goes. It may disappear completely for 6 months, then return (for 2 years I has it 2 times and all the time the pain is more then month and then it disappeared). It is usually milder in the morning, gradually becomes more noticeable during the day, and is often strongest before sleep. Touching or repeatedly checking the area can make it worse the following day.

How it started
The original episode began one or two days after unprotected sex with my long-term partner. At that time, she had vaginal/urinary burning. We assumed it was cystitis, but the exact cause was never clearly established.
Shortly after sex, I developed:
itching around the glans or urethral opening;
a warm or burning sensation near the right testicle or groin;
dragging discomfort extending toward the pubic area.
The stronger symptoms improved after approximately two weeks, but the right side remained more sensitive than before.
More recently, my partner again developed burning at the beginning of urination and a deeper pulling sensation at the end of urination. After another episode of unprotected sex, my itching and right-sided discomfort returned. The itching later settled, but the dragging/burning pain near the right testicle continued.

Previous diagnoses
Different urologists wrote the following diagnoses:
acute right-sided epididymitis;
orchitis, epididymitis, or epididymo-orchitis without abscess;
a small epididymal or tunica albuginea cyst;
a small 6 mm simple cyst in the left kidney.
However, I am not confident that the epididymitis diagnosis was firmly proven.
I was previously prescribed:
cefixime 400 mg once daily for 7 days;
trimethoprim-sulfamethoxazole for 5 days;
meloxicam;
later, dexketoprofen 25 mg twice daily for 5 days.
NSAIDs such as dexketoprofen did not noticeably improve the current pain.

Tests and imaging
A recent ultrasound of the testicles and epididymides was reported as normal. The doctor specifically said there was no current problem with the epididymis.
My recent general urinalysis was essentially normal:
very low leukocytes;
no nitrites;
no blood;
no meaningful bacteriuria on microscopy.
A urine PCR panel was negative for:
Chlamydia trachomatis;
Neisseria gonorrhoeae;
Mycoplasma genitalium;
Ureaplasma species.
The PCR sample may have been collected from a middle portion of urine rather than a perfect first-catch sample.
A urine culture did grow:
Enterococcus faecalis: 10⁴ CFU/mL
It was susceptible to ampicillin and nitrofurantoin, but resistant to trimethoprim-sulfamethoxazole, ciprofloxacin, and levofloxacin.
An older genital PCR test had also detected Gardnerella vaginalis, while chlamydia, Trichomonas, Candida, Ureaplasma, and Mycoplasma hominis were negative.

What I am trying to understand
Could Enterococcus faecalis at 10⁴ CFU/mL explain this kind of recurring groin/testicular pain despite a normal urinalysis and ultrasound, or could it be contamination or colonization?

Could this be:
chronic bacterial prostatitis;
chronic pelvic pain syndrome;
pelvic-floor muscle dysfunction;
spermatic-cord or epididymal nerve sensitization after the original episode;
ilioinguinal or genitofemoral neuralgia;
an occult inguinal hernia;
referred pain from the lower back, hip, or pelvic muscles;
something unrelated to urology?

Parrot owners, how do you cope?

We have two parrots (Pyrrhura) that are allowed to fly freely around the house because whenever we put them in their cage, they start screaming. They have plenty of perches, climbing areas, toys, and enrichment, but it still doesn't seem to help.

At first we only had one bird, and we thought getting a second one would make things easier because they could keep each other company. Instead, we now have twice as much poop and twice as much screaming.

Honestly, I'm struggling. When they're cuddling, preening each other, and being adorable, I can't imagine life without them. But when they start screaming nonstop, it fills me with pure rage. Sometimes I genuinely feel like my frustration hits 10/10.

They make it impossible to have a work meeting, watch TV, or focus on anything. Even if we move them to a room on the other side of the house, we can still hear them, and they can keep screaming for hours.

They poop on everything and have already damaged a lot of our belongings by chewing holes in them.

We've dedicated one room as their main space where we all spend time together. Another room contains plants and things we don't want destroyed, so they're only allowed in there under close supervision, which doesn't happen very often.

Is it possible to train parrots to use a designated toilet area? And how do you deal with the constant screaming?

I am trying to find a reliable and maintainable way to monitor Linux systems, but I am struggling to find the right approach. The default, out-of-the-box options don't give me what I need, but the advanced alternatives require too much maintenance.

Right now, my setup is very basic:

• SSH logs: I have specific alerts for things like non-existent usernames or logins from external IP addresses.
• Bash history: I use File Integrity Monitoring (FIM) via Wazuh just to alert when the history file changes. I also tried monitoring cron files with FIM, but I stopped doing that.

I have spent a lot of time testing other tools, but each had significant downsides:

• Auditd: There are many advanced rules and configurations available, but maintaining this service is difficult. The logs are not user-friendly, and you have to do extra work with Wazuh and OpenSearch decoders just to see the actual commands, because they are encoded in hex. I eventually gave up on Auditd because it takes too much time to manage.
• Tetragon (eBPF): I spent a lot of time trying to get this to monitor inbound and outbound traffic. The problem is that you need different queries for different Linux kernels and architectures. I got it working on Ubuntu 24.04 ARM, but the same config failed on x86-64. Testing different configurations across different distributions and versions is a huge time sink. You also need to write custom decoders to normalize the logs. For me it is a middle-ground option, like Auditd, it's generate huge noise of events.
• Falco: This works well as a runtime detection engine, but it is not designed to log all events to a SIEM. It is mostly focused on container and microservice security. While it has some overlap with standard Linux OS monitoring, it is not the right tool for full system logging.
• Sysmon for Linux: Out of the box, it did not show all event types, which means it requires a custom configuration file. However, out of all the options I tried, this is the one I like the most so far.

If you have experience with Linux security monitoring, how do you handle it? What tools or configurations do you use to get good visibility without spending all your time on maintenance?

Please share your thoughts and experience in the comments.

I’m evaluating modern SIEM / XDR / SecOps platforms and would appreciate input from people who have gone through similar selection or migration projects.

Context:
We have a relatively small security team - essentially one person responsible for security operations, but the environment is not small: several thousand servers, around 1.5k users, hybrid identity with Microsoft Entra ID and on-prem Active Directory, and a mixed OS estate that is currently about 40% Windows and 60% Linux, with more Linux migration planned.

What I’m looking for is not just a log storage/search platform, but a SIEM/SecOps solution that can realistically work for a very lean team.

Key requirements:

* Strong integrations with Microsoft identity, AD, Windows, Linux, network/security tools, cloud services, and custom applications.
* Flexible detection / alerting language, similar in spirit to Splunk SPL, KQL, YARA-L, Python-based detections, etc.
* Good support for custom log ingestion, because we have internal applications and products that we will need to integrate from scratch.
* Vendor-maintained detection content, not just a marketplace of rules we have to fully own ourselves.
* Strong ML/UEBA/anomaly detection capabilities.
* AI-assisted investigation would be a plus, especially if it can explain context, summarize incidents, suggest next steps, or help build detections - but this is not the main deciding factor.
* Ability to reduce operational overhead: tuning, rule updates, parsing, correlation, triage, and detection lifecycle should be as delegated as possible to the vendor or an MSSP/MDR partner.

As a reference point, we previously used Darktrace Network. I liked the idea that many detections/models were maintained by the vendor, were relatively flexible, and heavily ML-driven. I’m looking for something with a similar operational philosophy, but in the SIEM/SecOps space.

Platforms I’m considering include Microsoft Sentinel (good fit for us as I said we have Microsoft ecosystem), Google Security Operations (ex-Chronicle), PaloAlto (XDR, XSIAM), CrowdStrike (XDR, Next-Gen SIEM), any other modern SIEM/XDR options.

**The main question**:
For a one-person security team managing a large hybrid environment, which SIEM/XDR/SecOps platform would you recommend?

***DISCLAIMER: I understand that in our context, full outsource/MSSP/MDR are the best options, but we decided to start without them for now, with the intention of transitioning to MSSP/MDR later.***

I’d especially appreciate feedback on:

* real operational effort after deployment,
* quality of out-of-the-box detections,
* custom log onboarding,
* detection language flexibility,
* false-positive tuning,
* Linux visibility,
* Microsoft identity integration,
* vendor support quality,
* pricing predictability at scale.

We often see Defender being installed on non-corporate devices. In some cases, users access corporate services from their personal computers (Teams, desktop Outlook), or simply connect their work profile to Windows, which then triggers automatic antivirus enrollment on that device.

What I currently don’t understand is how these devices should be properly removed afterwards. What is considered the best practice for offboarding Defender from non-corporate devices? So far, I haven’t found a reliable way to remove it remotely.

Also, how can we prevent Defender from being automatically installed on personal/non-corporate devices in the first place?

Very rarely, but occasionally, I have to run actual malware in my sandbox VM to see what it’s doing.

The flow is: successful attack – I extract the malware – run it in my sandbox (a VMware instance that mimics our corporate devices, including all naming conventions) – analyze it via Procmon and Wireshark - gather IOCs – and pass them along.

Doing this manually is time-consuming. I mainly focus on IP addresses and file creation, and that’s about it. Then I search for these IOCs across our XDR/Firewall, identify the compromised devices, and send them all for a wipe. That’s the short version.

But maybe there are better ways to analyze this? Are there any 'cool' sandboxes out there? To be honest, my current method with Procmon and Wireshark takes a lot of time just to filter out the noise. Since I don't have to do this often, I haven't updated my toolkit in quite a while.