🎯 EDR, IDS, NSM, SIEM

📖 Quick glossary
* IDS (Intrusion Detection System) watches network or host activity and alerts when something looks suspicious. It doesn’t fix anything by itself
* NIDS / HIDS network IDS vs host IDS. NIDS watches traffic on the wire; HIDS watches files, processes, logs on the machine
* EDR (Endpoint Detection & Response) agent on endpoints that collects telemetry (processes, files, network), detects malicious behavior, and helps investigate & respond (isolate, kill process, etc.)
* NSM (Network Security Monitoring) full network visibility for hunting and historical packet analysis. More about forensic than just alerts
* SIEM (Security Information and Event Management) central system that aggregates logs/alerts from many sources, normalizes data, runs detections, and keeps searchable history
* Vulnerability scanner finds known CVEs in images, packages, OS. Not a detector; it’s preventive
* Audit tool checks systems against security baselines and compliance rules

🔧 What a real EDR needs
1. Endpoint agents collecting process, file, network, and logs
2. Central store + search
3. Detection rules + ability to add custom rules
4. Integration with network telemetry for context
5. Some response options (isolate host, kill process, quarantine file)
6. Vulnerability and config data to prioritise alerts
7. Long-term history for investigations

🧩 How to cover EDR
* Wazuh core of the endpoint story. Agents, log collection, file integrity, alerting, and a centralized manager. Acts like SIEM + HIDS. Good starting point for EDR capabilities
* OSQuery run SQL-like queries on hosts. Great for investigation and periodic inventory. Works well alongside Wazuh (feed OSQuery results into Wazuh)
* ClamAV basic malware scanning on files. Useful for quick scans and quarantine
* Falco runtime detection for containers / Kubernetes. Detect suspicious syscalls, container escapes. Use in any containerised infra
* Security Onion network side: IDS/NSM (Suricata/Zeek/Elastic). Gives packet-level visibility and network alerts to correlate with endpoint telemetry
* Trivy scan container images and repo dependencies (npm, pip). Run in CI and before deploy. Good for supply-chain CVE detection
* OpenVAS / GVM scheduled vulnerability scans of hosts and network services. Good for asset-level risk scoring
* OpenSCAP / Lynis regular configuration audits and compliance checks (CIS, etc.). Use for hardening and evidence for audits

✅ Combinations

1️⃣ EDR-like stack
* Wazuh (agents + manager) — collection, detections, alerts.
* OSQuery — deepen host visibility and hunting.
* ClamAV — file scans.
* Trivy theoretically can be used for for supply chain issue un runtime

2️⃣ Container / Kubernetes + endpoints
1 + Falco (runtime container detection) and Trivy (CI image scanning).

3️⃣ Network-aware, SOC setup
Security Onion + Wazuh + OSQuery + Falco + Trivy + OpenVAS.

4️⃣ Compliance & hardening
Run OpenSCAP / Lynis regularly and feed results into Wazuh.


🤔Final thoughts
Open-source combo gets you close to EDR, but it’s not a commercial EDR out of the box. Things that are harder with OSS and requires some efforts. But wazuh looks like an entry point into that world

#security #research

☁️VMware Migration Options

New licensing model leads to dramatic cost rise, time has come to search:

1️⃣Proxmox VE
Looks the like the most realistic choice for small/mid-size clusters. out of the box
- Web UI, terraform, packer
- Reliable live migration
- FC, multipath
- Low operational overhead


2️⃣ XCP-ng + Xen Orchestra
Very strong alternative. Slightly more enterprise-oriented than Proxmox. Extremely stable, widely used in hosting providers.
- XO (Xen Orchestra) provides an excellent management UI. also Packer/Terraform
- Live migration, FC
- Smaller ecosystem than Proxmox.

3️⃣Microsoft Hyper-V
- Best Windows guest support
- Stable live migration
- Works OK with FC
- Licensing might destroy budget
- Management is worse than Proxmox/XCP-ng unless using SCVMM (might cost something)

4️⃣ Vanilla KVM (libvirt)
Only makes sense if you want to build your own cloud. You don’t.
- Free
- Very flexible
- No cluster UI
- No centralized management
- Operational overhead becomes huge

🔗
1, 2, 3
#research

🎯 Lessons from Thinking, Fast and Slow

I’ve just finished Thinking, Fast and Slow by Daniel Kahneman. The book that basically explains how your brain constantly tricks you, and why most of our rational decisions are… not really rational. Here are the key takeaways I noted:

1️⃣ You have two brains in one
- System 1 fast, automatic, emotional.
- System 2 slow, effortful, logical.
- Most of the time, System 1 is driving, and System 2 just agree with System 1.

2️⃣ "The mind is lazy"
- If you don't see data, your brain pretends it doesn’t exist. It builds conclusions from whatever is available, even if it's not enough.
- Your brain loves a quick answer. Even when it's wrong, it feels right .
- System 1 (fast thinking) jumps to conclusions, and System 2 (slow thinking) rarely steps in unless you force it.

3️⃣ "We are prone to overconfidence."
- We think we know more than we actually do.
- Confidence feels good, but it doesn’t mean we’re right.

4️⃣ "Losses loom larger than gains"
- Losing €100 hurts more than winning €100 feels good. That’s why we avoid risks even when they’re rational.

5️⃣ "Small samples are not representative" and "We base decisions on stories, not statistics"
- You can’t make conclusions from 2–3 examples. But the brain loves patterns, even in random noise.
- We’re Bad at Statistics. People hate base rates. Probabilities feel abstract, stories feel real — so we trust stories.
- Your brain loves patterns, even where none exist. A few data points feel like “trends,” but they’re noise.
- A single emotional example beats dry numbers. Even when numbers are far more accurate.

6️⃣ "Anchors influence decisions"
The first number or fact you hear sticks in your head and shapes your final choice. Even if the number was random.

7️⃣ "A reliable way to make people believe falsehoods is repetition"
Say something often enough and the brain will treat it as true. This works for marketing… and for your own internal beliefs.

8️⃣ "The illusion of understanding"
- After something happens, it feels obvious. But before it happened, it wasn’t. The brain rewrites history to make events look predictable.
- Experts with strong opinions are often no more accurate than random guesses, just more confident.

9️⃣ "The remembering self and the experiencing self want different things"
What feels good in the moment isn’t always what you’ll remember as good. So we make decisions for nice memories, not for actual comfort.

❗️Summary:
Your brain wants simplicity, shortcuts, and nice stories, but reality is complex. The real superpower is noticing when System 1 is fooling you and choosing to switch into System 2, even if it’s uncomfortable.

#book

🗝 Password Manager

I’ve compared the most popular password solutions

1️⃣ Bitwarden Cloud
✔️ $10/year
➕ Perfect balance of price & features
➖ You depend on their cloud
❗️ Best value. easiest recommendation

2️⃣ Vaultwarden
➕ Fully under your control
➖You manage backups, updates, uptime
❗️Bitwarden but DIY. great if you self-host and know what you're doing.

3️⃣ KeePass + Sync
➕ Free
➖ Manual sync, manual backups
❓ Works without cloud, fully offline
❗️Maximum control, minimum comfort. ideal for paranoid users or air-gapped environments

4️⃣ Synology C2 Password
➕ Clean app, all needed features
➖ Not as polished as Bitwarden/1Password
❗️Surprisingly good but not so well spreaded

5️⃣ 1Password
➕ Everything works flawlessly
➖ Expensive
❗️The polished, premium solution. choose it if design & experience matter more than price

6️⃣ LastPass
✔️ E2EE and feature set still solid on paper
➖ History of breaches
❗️Used to be good… but had breaches. hard to recommend with its track record
#security #research

🎉Advent of Sysadmin 2025

Right now there is cool advent https://sadservers.com/advent feel free to participate.

Ps also CFP for hashitalks 2026 is closing 2025-12-07 feel free to apply. I’ve applied with speech about terraform for VMware
#news #sysadm

🗣 How to speak

I watched Patrick Winston’s How to Speak https://www.youtube.com/watch?v=Unzc731iCUY and it correlates a lot with my thoughts https://www.goncharov.xyz/life/how-to-make-speech-en.html

However I've spotted some new ideas:
1️⃣ Impact = f(Knowledge, Practice, Talent). Talent to speak is more lightweight than Knowledge
2️⃣ Start with an empowerment promise. Do not start from jokes. Tell people what they will know at the end that they don’t know now yet. Makes the hour meaningful.
3️⃣ Cycle. Say things three times: Tell them, tell them again, remind them. Repetition increases the chance everyone gets it.
4️⃣ Build a fence around your idea. Say what it is - and what it is not. Prevent confusion with other similar ideas.
5️⃣ Ask one good question. A short, non-embarrassing question wakes people up and makes the talk interactive. Pause up to 7 seconds is OK.
6️⃣ Prefer props for teaching. Writing at the board or demonstrating props is the right speed for people to absorb ideas. Props create empathy, people mirror actions.
7️⃣ Use memorable props or demos. It turns abstract into physical, so people remember props far more than bullet lists.
8️⃣ Show vision fast (< 5 minutes). State the problem and what you’ve done - list steps and contributions. People decide quickly if you have impact.
9️⃣ Winston’s Star for memorability. Give your work a: Symbol, Slogan, Surprise, Salient idea, and a Story. One clear sticky idea beats many good ones.
🔟 End with contributions, not thank you. Final slide = what you did. Leave people with your contributions visible while they ask questions and walk out. Also you can make a joke at the end

🔗 you also can take a look onto https://www.coursera.org/learn/public-speaking

P.s. Also he created two awesome courses. I really insist to watch them:
- https://www.coursera.org/learn/algorithms-part1
- https://www.coursera.org/learn/algorithms-part2

#review

🎯 Booting PC from a Vinyl Record

Found a fun engineering experiment: booting PC from a vinyl record. Yes, literally.
https://boginjr.com/it/sw/dev/vinyl-boot/

What’s the trick?
Early IBM PCs had a cassette interface. It could load data from analog audio.

The author:
- encoded a 64 KB boot image as audio,
- pressed it onto a vinyl record
- connected a turntable to the PC’s cassette input
- PC listens to the record, decodes the sound into bits, loads everything into RAM and boots FreeDOS.

TL;DR
If you can turn sound into bits, you can boot from it.
Vinyl included.

#fun #retro #hardware

🎯 How I really estimate work

I read How I estimate work as a staff software engineer and pulled the core ideas:

1️⃣ Accurate estimates are impossible for most work
Most of work involves unknowns that you can’t predict until you explore them. Only tiny, well-understood tasks are easy to estimate.

2️⃣ Estimation isn’t for engineers, it’s for managers
Managers often come with a timeline in mind first. Engineering isn’t really choosing the estimate. It’s choosing what work can be done within that estimate.

3️⃣ Unknowns dominate known work
Known tasks are predictable. Uncharted code paths and interactions take most of the time and those you can’t numerically nail down in advance.

4️⃣ Start with context, not code
Before reading any sources, figure out what timeline is expected, how urgent the project is, and what trade-offs are acceptable.

5️⃣ Don’t ask how long will it take? ask what fits in this time?

6️⃣ Focus on unknowns, not on known tasks

7️⃣ Give plans with trade-offs, not flat numbers
Instead of 4 weeks, present options like:
- full solution (risky)
- simplified approach (quicker)
- help from another team (less risk)

8️⃣ Sometimes you must say this is impossible

Summary:
Estimating isn’t about predicting time. It’s about mapping technical options to business expectations under uncertainty.
Good estimation = understanding what you don’t know and managing the risks.

#til

🔫Doom via Telnet

just run

telnet doom.w-graj.net 666

Action Default Keybind
UP ARROW UP
DOWN ARROW DOWN
LEFT ARROW LEFT
RIGHT ARROW RIGHT
STRAFE LEFT ,
STRAFE RIGHT .
FIRE SPACE
USE E
SPEED ]
WEAPON SELECT 1-7

it really works. more details https://github.com/wojciech-graj/doom-ascii

PS it's better to use the dark mode like in the coments

#til #ascii

🤖microbit

I've just found quite promising project for kids: https://microbit.org/

There is gui, javascript & python to have some fun with kids. They can start just from GUI and can program it. however initializating is a bit tricky

#DYI

🌧terminal weather app

It draws current weather via ASCII animations. It's driven by real-time weather data.

https://github.com/Veirt/weathr

brew install Veirt/veirt/weathr
mkdir -p ~/Library/Application\ Support/weathr

cat >> ~/Library/Application\ Support/weathr/config.toml <<EOL
hide_hud = false
silent = true
[location]
auto = true
hide = false
[units]
temperature = "celsius"
wind_speed = "kmh"
precipitation = "mm"
EOL

have fun

#ascii

DHCP irl

#fun