Week 1 of 31 Days Safer, one layer deeper. The daily tips gave you the moves; this post gives you the why — how credential stuffing, SIM-swapping, and social-media recon actually work, and why your accounts are a chain attackers pull at the weakest link. Non-technical, but technically accurate.

What I'm building this October: two anchor projects — the 31 Days Safer challenge and an open-source detection skill that maps alerts to MITRE ATT&CK — plus an "open workbench" where Hacktoberfest's weekly challenges are letting me explore what else I can build within the brand.

There are a hundred cybersecurity challenges this October, and most are the same checklist. This one's different: it teaches the reason behind every habit, not just the rule — the "does this belong here?" detection lens a SOC analyst uses on every alert, aimed at your own digital life.

Everyone knows not to click the link — but nobody explains why. 31 Days Safer is a month-long digital hygiene challenge that gives you one small security habit a day, plus the threat behind each one. Free tracker included. Small steps for a safer digital life, from DataSec Chronicles.

Hacktoberfest changed this year — no more counting pull requests, it's about building with open-source AI. So I'm writing an open-source skills.md that maps a security alert to the MITRE ATT&CK framework: the daily reasoning of a SOC analyst, packaged in public. Here's the plan, out loud so I finish it.

The comeback half of my SC-900 story. After failing by 32 points, I scored 90% on the Microsoft practice assessment four days later. Here's how I'm closing the gap: letting my score report target the right domain, drilling the formats that beat me, and knowing what each practice source can and can't tell me.

The honest version of my SC-900 exam experience: I scored 668/700, 32 points short. How the online-proctored setup compared to my CC exam, the true/false and drag-and-drop formats that caught me, what my score report revealed, and exactly how I'm approaching the retake.

Microsoft has a Defender for everything, a SIEM with a sci-fi name, and a Zero Trust philosophy that gets name-dropped into meaninglessness. Here's the SC-900 Security Solutions stack untangled — what each tool does, how Zero Trust, the Defenders, XDR, and Sentinel connect, and where a data mindset already fits.

You already have the analytical muscle memory cybersecurity hiring managers are looking for — you just describe it in the wrong dialect. Here's how to translate years of SQL, anomaly detection, and log work into the language SOC teams actually hire for, plus a two-question test to audit your own resume: which experience transfers, and which gaps you still need to build.

What to put in a cybersecurity portfolio when you're coming from a data background — how to structure it, what each project signals to a recruiter, and how to know which roles are actually your lane. Plus a free bingo board to start today.

I loaded 109,864 events into Splunk and went hunting for the noisiest host on the network. My first query found a suspect. My next two proved it innocent — and somewhere in the middle I realized I'd been writing this query language for ten years without knowing its name.

When people hear I'm moving from data analytics into cybersecurity, they picture a hard reset. Then I started paying attention to what I'd already been doing — building sandboxes, hunting anomalies, testing before trusting. This is the story of the security instincts I had long before I had the language for them.

Part 2 of the Zeek threat hunt: using SQL to detect C2 beaconing on a fixed cadence, internal reconnaissance across 771 hosts, and a confirmed SSH intrusion — plus the timeline that showed the network was compromised before the attacker I could see ever logged in.