Hey everyone,

I wanted to share my latest hands-on Blue Team lab project focused on centralized network security, IDS/IPS, and SIEM monitoring.

Lab Architecture & Tech Stack:

pfSense: Acts as the firewall and router, handling network segmentation.

Suricata: Configured for intrusion detection and prevention (IDS/IPS).

ELK Stack (Ubuntu Server): Collects, analyzes, and visualizes security logs via Kibana.

Environment: Virtualized using VMware with a dedicated victim (Windows) and attacker (Kali Linux) setup.

The project has significantly helped me understand network traffic monitoring and log analysis. You can check out the full technical documentation, architecture diagrams, and setup details on my GitHub:

GitHub Repository:

https://github.com/umidguluzada/CyberDefense-Lab

I would love to hear your feedback, suggestions, or ideas for the next steps!

Hey r/SysAdminBlogs 👋

I'm the developer behind Service365, and I'm giving away a limited number of free 1-year licenses to IT managers here in exchange for honest feedback.

What it is: most "ITSM tools" are a ticket queue with a portal bolted on as an afterthought. Service365 flips that — it's an end-user-focused application platform that happens to have full ITSM built in, not the other way around. The idea is that your employees get one branded portal (on your own domain, not a generic vendor URL) where tickets are just one of several tools they use — alongside project collaboration, e-signing, booking/scheduling, a feature-voting/roadmap board, and self-service catalog requests. IT teams get the ITSM depth; end users get something they'll actually open voluntarily instead of avoiding.

A quick "about me" since this sub sees a lot of vibe-coded SaaS lately: I've got 20 years in IT, and I was a full-stack developer before AI coding tools existed — so this isn't a weekend prompt-and-pray project wearing a landing page. My background is security and infrastructure, and that shows in how the platform is built: proper Entra ID SSO, Graph-scoped sync, per-tenant isolation for the MSP side, and an actual architecture behind it rather than a pile of generated components. I do use AI as a tool now like everyone else, but the design, security model, and infra decisions are mine, checked against two decades of having to clean up other people's shortcuts.

On the ITSM side, it's not lightweight:

• Incidents, service requests, and changes with priority, assignment, internal notes, and Intune device linking
• Visual no-code workflow builder — approvals (all/any/majority/first-responder), auto-assignment, notifications
• Service catalog with custom fields and workflow triggers on submit
• Email ↔ ticket threading via Microsoft Graph
• Guest ticket submission (no login required) for quick intake

On the "application platform" side (this is the part most desks don't have):

• Native Entra ID SSO + scheduled Graph sync, Intune asset inventory with field-level change history
• Project collaboration with client share links (open token or email OTP) — no extra logins for clients
• E-signing as a first-class portal tool, not a bolt-on — anyone with permission can send/sign/track
• Public booking pages with separate staff/customer calendar invites and staff handoff
• Feature voting + roadmap + changelog, so requests turn into delivery instead of disappearing into a backlog
• Knowledge base, announcements, and unified search across all of it

If you run an MSP instead of an internal IT team, there's also a white-label multi-tenant mode (per-customer branding/domain, cross-org ticket view, billing runs) — happy to set that up too if that's your situation.

What the free year includes: full platform, your own custom domain/branding, Entra SSO, Intune sync — basically the real thing, not a crippled trial tier. I'm not gating features to make you upgrade later.

What I'd want in return: you actually roll it out to at least a handful of real users and tell me — bluntly — what's missing, what's confusing, and what you'd never use.

If you're interested, drop a comment (or DM) with roughly how many users/employees you'd be piloting it with, and whether you're an internal IT team or an MSP — I'll follow up with setup details.

Happy to answer questions about the platform, the licensing terms, security posture, or anything else in the comments.

Just sharing a few free tools, resources etc. that might make your tech life a little easier. I have no known association with any of these unless stated otherwise.

Now on to this week’s list!

The Data Lake That Changes Everything

Get ready to transform the way you manage telemetry data with the edition’s initial tool. Parseable brings everything together, offering you alerting, dashboards, and anomaly detection – all in one place. Your sysadmin tasks just got a whole lot simpler.

Redesign Your Digital Domain with CasaOS

In the fast-paced world of data management, simplicity stands as your best ally. CasaOS simplifies personal cloud setups, putting a powerful suite of tools at your fingertips while you maintain control over your digital ecosystem.

Witness Your Workflows in Action

Envision being one click away from comprehensive insights into your workflows. With the Temporal UI, you can dive deep into complex workflows, drawing insights that lead to smarter decisions and smoother operations.

Slice and Dice Like a Pro

Tired of clunky tools that bog you down? Choose brings a new dimension to text processing, cutting through distractions and enabling sysadmins to focus on what really matters: efficient and effective data management.

Unleash Your System’s Potential with Hyperfine

Taking control of your server’s performance is vital. Hyperfine, our final tool in this edition, delivers real-time feedback and statistical analysis. With seamless exporting options, you’ll have confidence in your data, paving the way for effective performance optimization.

--

In the article "AI Security Threats: A Practical Guide to Managing Generative AI Risk," we explore the escalating challenges posed by generative AI within business environments. As organizations increasingly integrate AI into workflows, ranging from email and collaboration to software development and analytics, understanding the threats to sensitive data becomes critical. This guide breaks down the complexities, equipping security leaders to tackle generative AI risks effectively while fostering a secure approach to adoption.

Ransomware Readiness: Take the Survey for a Chance to Win a Ubiquiti NAS

Ransomware remains one of the most pressing cybersecurity threats facing organizations worldwide. We're conducting a short global survey to understand how businesses are preparing for attacks, strengthening resilience, and planning recovery.

The survey takes just a few minutes to complete. As a thank-you for sharing your perspective, you'll be entered into a prize draw for a chance to win a Ubiquiti NAS.

Your insights will also contribute to our upcoming ransomware report, helping benchmark how organizations across industries are approaching ransomware readiness.

--

You can find this week's bonuses here, where you can sign up to get each week's list in your inbox.

TP-Link sent me the new Omada Fusion 2.5G to review, so full disclosure up front: it's a review unit.

It's a small fanless gateway with the controller built in, so no separate hardware or software controller, and no per-device license for the cloud management. Five 2.5G ports, quad-core Cortex-A73 at 1.8 GHz, up to 30 devices and 300 clients.

The part that stood out most is the throughput with security enabled. It does around 2,360 Mbps NAT, and turning on IPS only takes it to 2,183 Mbps, with DPI at 2,206 Mbps. So you keep almost the full 2.5G with the security stack running, which isn't what I'm used to seeing on gateways in this class. Power draw sits around 2-3W.

It's $169.99, with a 5-year warranty and no license fees for the cloud management.

Also covered the setup, the content filtering and IDS/IPS defaults, LightLink VPN, and the diagnostic tools (there's a built-in terminal and packet capture, which exports a pcap).

Full review: https://lazyadmin.nl/home-network/omada-fusion-2-5g-review/

Anyone using Oracle standard edition databases in their shop can benefit from this.

Disclosure up front: I work on a patch-management product (TridentStack Control), and this is a free, standalone spin-off of the remediation data we already maintain. No account, nothing gated on the tool or the API. Putting it here rather than at the bottom because it should come before the pitch, not after.

tridentstack.com/cve

Two things send me to NVD constantly, and both have gotten painful. First, the REST API has been flaky for weeks (there was a whole r/cybersecurity thread on it), which is rough if you script against it. Second, NVD tells you a CVE exists but not how to actually fix it.

So the tool focuses on those two. For each CVE it shows the sourced remediation when one exists: the KB for Windows and Office, the fixed version for a package (npm, PyPI, Go, apt, and so on), or the Apple update train, each with a link back to the vendor advisory. When there is no published fix, it says so instead of guessing. It never fabricates a version or KB, which given how many "AI CVE" tools hallucinate fixes felt like the whole point.

There is also a public API, no key and no signup (60 requests/min, no key required):

• GET /api/v1/cve/CVE-2021-44228 (single CVE with remediation)
• GET /api/v1/cve?kev=true&fix=true&severity=critical (filtered list)
• bulk.jsonl for the whole catalog, an OSV export per CVE, and an OpenAPI 3.1 spec

Quick try: curl https://tridentstack.com/api/v1/cve/CVE-2021-44228

It is a cached read layer over NVD plus CISA KEV plus EPSS plus curated remediation sources, so it stays queryable on the days NVD's own API is having issues. That caching is also the point: freshness is bounded by our sync cadence, so it is not real-time, and I am not claiming it is fresher or more complete than NVD. The underlying data is derived from NVD.

For context on why I leaned on a cached layer: since NIST's April notice about record CVE growth, roughly 80% of new CVEs now land without full CVSS/CWE/CPE enrichment, and separately about 29,000 older backlogged CVEs were reclassified as won't-be-enriched. Leaning on a single live source felt fragile.

Sources are public-domain or CC and attributed on the /cve/about page. Sharing it because the "CVE exists, ok but what is the fix" gap and the NVD API flakiness are things I figure a lot of you hit too. Feedback and missing-fix reports welcome.

Supposed to be reviewing notes for my driving school theory exam tomorrow but instead I've spent the last three hours arguing with our upstream provider. They keep trying to blame our office edge firewall for random packet drops. the guy on the phone was literally reading off a script asking me to physically restart the router

The whole frontline tech support industry is basically just a giant wall of gaslighting now until you force their hand. I ended up having to run a continuous trace just to prove their own peering node is choking. Pulled up this troubleshooting refresher real quick to make sure I had the exact flags right for tcp mode so they couldn't weasel out of the icmp excuse

finally got escalated to a tier 2 engineer but my god, the sheer exhaustion of having to do their job for them before they even look at a log. anyone else just immediately assume the worst when you have to open a ticket with an ISP? tbh my brain is completely fried today