What I am doing this month.
A now page: the short, current answer to "what are you working on?", kept honest by being dated.
Building
- The first credentialed scan from SCAN01, now that the scanner has an identity that is an administrator on member machines and nothing on the domain. How that was scoped.
- The last unmonitored host in the lab: a Wazuh agent on APP01 and the first real rule on the DevOps interface. Three agents already report.
- Hardening DC01 and ADM01 against their CIS baselines (both 26%) and recording the delta. Why the baseline came first.
- Rebuilding MON01 and ANS01 as Proxmox guests, and giving Vault its own guest on the DevOps VLAN.
- Writing the last three pfSense rulesets (BlueTeam, DevOps, Monitoring) to default-deny, each rule justified and mapped.
- Rebuilding the identity lab. The forest is done and running as corp.biirabank.com; the Okta org comes next, in Terraform so it can be replayed rather than reclicked.
Studying
- AZ-104 Azure Administrator: prep course at 93%, exam next.
- SC-200 Security Operations Analyst: prep course at 89%.
- Practical SOC Analyst (TCM Security): SOC 101 at 40%, working through the investigation labs.
Thinking about
- Treating an AI agent as a non-human identity: an AD service account, short-lived Vault credentials, firewall-scoped reach and a Wazuh audit trail, built in the lab.
- What "evidence" means for a homelab: naming, registers and change logs that an auditor could follow, not just screenshots.
Talking about
- Hybrid identity design, homelab builds, and the certification path. Say hello.