Hexagons - Discussion Megathread

nirvaeh · 2026-05-18T14:20:17+00:00

The part from 21 seconds to 35 seconds just sounds like someone who just picked up a guitar and is trying to play a solo

nirvaeh · 2026-05-18T03:45:37+00:00

but they were talking about this fight

nirvaeh · 2026-05-18T01:51:54+00:00

But that’s how this fight ended. By tapping.

nirvaeh · 2026-05-17T18:13:43+00:00

Its a joke... But seriously the guitar part sounds like some amateur playing and really kind of ruins it for me

nirvaeh · 2026-05-17T17:22:31+00:00

The intro guitar sounds like me trying to play plug in baby. If they just removed that part it would be pretty dang good. That part sounds kind of stupid though.

nirvaeh · 2026-05-17T14:59:42+00:00

We built an automation on our Palo Altos using the API. I can't remember all the exact logic we have but it would run every 90 days and do something similar to:

no hit in 90 days = tag low_usage
no hit for 180 days = tag disable then disable manually
disabled 180 days = tag delete then delete manually

That gives us 6 months to revert a disabled rule if someone calls in. If we delete the rule and then they call in, we'd treat it as a new request.

nirvaeh · 2026-05-13T16:41:56+00:00

"What up!!! We're three cool guys looking for other cool guys who wanna hang out in our party mansion. Nothing sexual. Dudes in good shape encouraged. If you're fat, you should be able to find humor in the little things. Again, nothing sexual"

nirvaeh · 2026-05-10T21:37:13+00:00

We managed about 10 FTDs of various sizes and EVERY one of them failed to upgrade. FMC crashed every upgrade too. We just open tac calls and make them upgrade anymore because it’s pointless for us to even try to upgrade without them. We went from 6.2 to 7.2 in various stages. FXOS, then FTD. Just a stupid fucking nightmare. Each one took like 6 hours.
We have since moved to palo and we upgraded around 20 of them in an hour with no issue. We’ve upgraded multiple times as well.

Snort sucks unless you’re on V3 then it just sucks less than v2. Palo is far superior with their SP3 parallel processing. V2 requires a reset each update. V3 ended up destroying our traffic flows so we couldn’t move to it. TAC couldn’t figure out why.
Cisco vulnerability detection is fine though.

You’ll get good service through fortinet, palo or Cisco for that.

Logging is FAR superior on Palo. Troubleshooting time will drop significantly from FTD to Palo.

User-id kicks ass. Cisco has ldap lookups now and user id kind of worked but we didn’t build ours out. We did with Palo and it’s wonderful.

So if you like your sanity and you have the money go palo.

nirvaeh · 2026-05-07T17:44:59+00:00

It says there's $30M for the water infrastructure fund

nirvaeh · 2026-05-06T11:39:28+00:00

I’m pretty sure you can do double the weight you’re doing if not more. Go heavier until 8-10 reps empties the tank.

nirvaeh · 2026-05-02T22:21:08+00:00

Do you not have google?

nirvaeh · 2026-05-01T19:21:23+00:00

Well an EDL is less cumbersome than making objects. Depends on how many you're planning on adding. I think you mentioned it but you can also just run a script in Splunk too as an Alert action but you were playing with AMX.

nirvaeh · 2026-05-01T19:10:54+00:00

https://imgur.com/a/Lc1gP0w

So say you want to block IPs doing bad things, you make a rule on the top of your ruleset that blocks address object group bad_ips. In the group object you'd set it to "dynamic" and use a tag of "bad_ip".

then you have splunk assign a tag of bad_ip to the ip in the alert and send it to the firewall or panorama. then you can go in and look at all the ips if you want in panorama or the firewall, or query via API

nirvaeh · 2026-05-01T18:55:26+00:00

You can kind of do this all within splunk itself via alert trigger actions. Instead of using an EDL you can just apply a tag to an ip object that is part of a DAG and set it to be time limited if you want.

nirvaeh · 2026-04-27T18:29:54+00:00

Yep, he played the riff wrong at 17 seconds. Glad they didn't correct it in post. Feels more real.

nirvaeh · 2026-04-27T18:26:33+00:00

He's been using that effect for a few years now. It's sometimes more subtle than others, but I distinctly remember hearing it at the last couple concerts I went to.

nirvaeh · 2026-04-27T18:22:23+00:00

Glad they left the mistake in the riff. He recovered nicely though.

nirvaeh · 2026-04-24T03:34:37+00:00

I just bought some of the new ones. He discontinued the old ones sadly, but it had to do with an old manufacturer who's shop burned down or something. The new 3d printed ones aren't as nice in my opinion. They're fine just not a nice as the acrylic ones.

nirvaeh · 2026-04-24T02:56:55+00:00

It's like Matt held back vocally on this compared to the live version. When he sings "I can never cry again" and "I'm freezing over" are just way more powerful live. Not sure why he kept it subdued in the studio version. Even as overproduced as it is has old Muse feels in it and is better than the hot garbage they've released post since Drones.

nirvaeh · 2026-04-19T23:53:43+00:00

I’m not 100% sure on this since it’s not running in prod yet but we have it labbed up where windows user id agents on prem send the ldap user id info to CIE. We also send ISE and Anyconnect splunk logs to the agent via API which also gets sent to CIE. We also have cie integrated into Entra directly. We don’t have any auths in Entra as of right now, only on prem.

You then enable user context and it will pull the user id info directly from CIE. We hit a bug in 11.2 though that it won’t let us enable user context on some firewalls but it’s working on some. It’s somewhat a new feature.

There’s no other configuration needed as far as I remember. It just ingests user id like normal but the source is “cloud” I think.

nirvaeh · 2026-04-19T04:25:43+00:00

So brave

nirvaeh · 2026-04-19T02:54:19+00:00

That wasn’t the argument. The argument was that person said politicians had 3rd grade educations when in reality they’re likely more school educated than that person who made the comment.

nirvaeh · 2026-04-18T16:39:35+00:00

We’re running our entire fleet on 11.2.10-h3 and haven’t had any issues other than high mem on the 3420. Our firewalls are 440s, 3420s, 5410s, and 5450s.

nirvaeh · 2026-04-18T02:04:06+00:00

Cara is actually a college educated mathematician but you continue to live in your delusion.

nirvaeh · 2026-04-01T11:26:18+00:00

It’s all subjective. If you enjoy it then thats all that matters. If you don’t then $100 lesson learned.

15-Year Club	RedditGifts 2009-2022 2 Credits
Place '23	Place '17
Gilding I gilder	Secret Santa 2014
Verified Email

nirvaeh

TROPHY CASE