What I'm building this October: two anchor projects — the 31 Days Safer challenge and an open-source detection skill that maps alerts to MITRE ATT&CK — plus an "open workbench" where Hacktoberfest's weekly challenges are letting me explore what else I can build within the brand.

Hacktoberfest changed this year — no more counting pull requests, it's about building with open-source AI. So I'm writing an open-source skills.md that maps a security alert to the MITRE ATT&CK framework: the daily reasoning of a SOC analyst, packaged in public. Here's the plan, out loud so I finish it.

The comeback half of my SC-900 story. After failing by 32 points, I scored 90% on the Microsoft practice assessment four days later. Here's how I'm closing the gap: letting my score report target the right domain, drilling the formats that beat me, and knowing what each practice source can and can't tell me.

The honest version of my SC-900 exam experience: I scored 668/700, 32 points short. How the online-proctored setup compared to my CC exam, the true/false and drag-and-drop formats that caught me, what my score report revealed, and exactly how I'm approaching the retake.

Tomorrow I sit the SC-900. This morning, I’m taking stock of where my head is — what feels different from my last certification attempt, what the practice numbers taught me, and the calm that comes from knowing I prepared honestly.

Microsoft has a Defender for everything, a SIEM with a sci-fi name, and a Zero Trust philosophy that gets name-dropped into meaninglessness. Here's the SC-900 Security Solutions stack untangled — what each tool does, how Zero Trust, the Defenders, XDR, and Sentinel connect, and where a data mindset already fits.

Nine years in data turned out to be worth more on SC-900 than I expected — but not everywhere. A domain-by-domain walkthrough of all four SC-900 skill areas, mapped honestly to a data-analyst background: what already transfers, what's brand-new, and where my real practice gap still sits.

SC-900 on September 20 is my first online-proctored exam — and after a test-center anomaly ended my first CC attempt, I'm controlling every variable I can. Here's my OnVUE system-test walkthrough, the admission rules that actually matter, and the exam-day checklist I built from them.

The honest middle of cert prep. I scored 62% on a full-length SC-900 practice exam, lost momentum during a busy week, then got it back with targeted drilling. Here are my real numbers, where my misses still cluster (Compliance), the tools I'm using, and my final-week plan.

I added SC-900 to an already-full August — mid-CC-retake, deep in camp season. Here's the honest version: the free voucher I refused to waste, why I swapped down from SC-200, the 40% cold baseline that sealed it, and how two exams became one reinforcing study block.

I booked SC-900 for September — then deliberately didn't set a Security+ date. Here's why the missing date is the strategy, not a lack of one: what finishing the full SC-900 course taught me about pacing and what an honest, unrushed path to Security+ actually looks like.

I haven't been to a hacker con yet — so I built the shortlist. Where I'm trying to be, in what order, and why: local meetups now, BSides and WiCyS in the spring, and DEF CON by 2027.

You already have the analytical muscle memory cybersecurity hiring managers are looking for — you just describe it in the wrong dialect. Here's how to translate years of SQL, anomaly detection, and log work into the language SOC teams actually hire for, plus a two-question test to audit your own resume: which experience transfers, and which gaps you still need to build.

The module said 20 minutes. It took me 42 — and those extra minutes are the whole post. My first run through MISP, the Malware Information Sharing Platform: how threat intel platforms turn one indicator into a resolved IP, a registrant email, and a whole map of an adversary's infrastructure. Plus the search bug I caught in my own technique that a decade with data should have caught sooner.

What to put in a cybersecurity portfolio when you're coming from a data background — how to structure it, what each project signals to a recruiter, and how to know which roles are actually your lane. Plus a free bingo board to start today.

I loaded 109,864 events into Splunk and went hunting for the noisiest host on the network. My first query found a suspect. My next two proved it innocent — and somewhere in the middle I realized I'd been writing this query language for ten years without knowing its name.

I set out to install Splunk Free and write a tidy walkthrough. Instead I hit four errors, discovered the tutorial was built for a machine that isn't mine, and had to force-restart my laptop — and learned more than a clean install ever would have taught me.

No cloud account, no labeled attack data — just SQL and Python on 2.8 million network flows. An Isolation Forest flagged suspicious traffic blind, and tuning it surfaced a counterintuitive truth about where attacks actually hide. A data analyst's field notes from the pivot into security.

When people hear I'm moving from data analytics into cybersecurity, they picture a hard reset. Then I started paying attention to what I'd already been doing — building sandboxes, hunting anomalies, testing before trusting. This is the story of the security instincts I had long before I had the language for them.

Part 2 of the Zeek threat hunt: using SQL to detect C2 beaconing on a fixed cadence, internal reconnaissance across 771 hosts, and a confirmed SSH intrusion — plus the timeline that showed the network was compromised before the attacker I could see ever logged in.