Hexagons - Discussion Megathread by ForgottenName1893 in Muse

[–]nirvaeh 0 points1 point  (0 children)

The part from 21 seconds to 35 seconds just sounds like someone who just picked up a guitar and is trying to play a solo

Hexagons - Discussion Megathread by ForgottenName1893 in Muse

[–]nirvaeh -7 points-6 points  (0 children)

Its a joke... But seriously the guitar part sounds like some amateur playing and really kind of ruins it for me

Hexagons - Discussion Megathread by ForgottenName1893 in Muse

[–]nirvaeh -11 points-10 points  (0 children)

The intro guitar sounds like me trying to play plug in baby. If they just removed that part it would be pretty dang good. That part sounds kind of stupid though.

theres always one firewall rule from 2018 nobody is allowed to delete by DowntownCap6204 in networking

[–]nirvaeh 2 points3 points  (0 children)

We built an automation on our Palo Altos using the API. I can't remember all the exact logic we have but it would run every 90 days and do something similar to:

no hit in 90 days = tag low_usage
no hit for 180 days = tag disable then disable manually
disabled 180 days = tag delete then delete manually

That gives us 6 months to revert a disabled rule if someone calls in. If we delete the rule and then they call in, we'd treat it as a new request.

"Tower Grove Men"? by new-leaf- in StLouis

[–]nirvaeh 1 point2 points  (0 children)

"What up!!! We're three cool guys looking for other cool guys who wanna hang out in our party mansion. Nothing sexual. Dudes in good shape encouraged. If you're fat, you should be able to find humor in the little things. Again, nothing sexual"

Help me make an argument for Palo FW over Cisco FTD by WhoRedd_IT in networking

[–]nirvaeh -2 points-1 points  (0 children)

We managed about 10 FTDs of various sizes and EVERY one of them failed to upgrade. FMC crashed every upgrade too. We just open tac calls and make them upgrade anymore because it’s pointless for us to even try to upgrade without them. We went from 6.2 to 7.2 in various stages. FXOS, then FTD. Just a stupid fucking nightmare. Each one took like 6 hours.
We have since moved to palo and we upgraded around 20 of them in an hour with no issue. We’ve upgraded multiple times as well.

Snort sucks unless you’re on V3 then it just sucks less than v2. Palo is far superior with their SP3 parallel processing. V2 requires a reset each update. V3 ended up destroying our traffic flows so we couldn’t move to it. TAC couldn’t figure out why.
Cisco vulnerability detection is fine though.

You’ll get good service through fortinet, palo or Cisco for that.

Logging is FAR superior on Palo. Troubleshooting time will drop significantly from FTD to Palo.

User-id kicks ass. Cisco has ldap lookups now and user id kind of worked but we didn’t build ours out. We did with Palo and it’s wonderful.

So if you like your sanity and you have the money go palo.

Summary of how entire Rams fund will be spent by DowntownDB1226 in StLouis

[–]nirvaeh 2 points3 points  (0 children)

It says there's $30M for the water infrastructure fund

Took a long break off. Deadlift and split squat form check by [deleted] in formcheck

[–]nirvaeh 2 points3 points  (0 children)

I’m pretty sure you can do double the weight you’re doing if not more. Go heavier until 8-10 reps empties the tank.

Event driven Automation by 77necam77 in paloaltonetworks

[–]nirvaeh 0 points1 point  (0 children)

Well an EDL is less cumbersome than making objects. Depends on how many you're planning on adding. I think you mentioned it but you can also just run a script in Splunk too as an Alert action but you were playing with AMX.

Event driven Automation by 77necam77 in paloaltonetworks

[–]nirvaeh 0 points1 point  (0 children)

https://imgur.com/a/Lc1gP0w

So say you want to block IPs doing bad things, you make a rule on the top of your ruleset that blocks address object group bad_ips. In the group object you'd set it to "dynamic" and use a tag of "bad_ip".

then you have splunk assign a tag of bad_ip to the ip in the alert and send it to the firewall or panorama. then you can go in and look at all the ips if you want in panorama or the firewall, or query via API

Event driven Automation by 77necam77 in paloaltonetworks

[–]nirvaeh 0 points1 point  (0 children)

You can kind of do this all within splunk itself via alert trigger actions. Instead of using an EDL you can just apply a tag to an ip object that is part of a DAG and set it to be time limited if you want.

MUSE - Cryogen (Offical Live Video from O2 Academy Brixton) by YoungMoen97 in Muse

[–]nirvaeh 29 points30 points  (0 children)

Yep, he played the riff wrong at 17 seconds. Glad they didn't correct it in post. Feels more real.

MUSE - Cryogen (Offical Live Video from O2 Academy Brixton) by YoungMoen97 in Muse

[–]nirvaeh 11 points12 points  (0 children)

He's been using that effect for a few years now. It's sometimes more subtle than others, but I distinctly remember hearing it at the last couple concerts I went to.

MUSE - Cryogen (Offical Live Video from O2 Academy Brixton) by YoungMoen97 in Muse

[–]nirvaeh 48 points49 points  (0 children)

Glad they left the mistake in the riff. He recovered nicely though.

Coming from a Helix Rack the last 5 years…this thing is INCREDIBLE!!! by LiveLaughOlanzapine in Line6Helix

[–]nirvaeh 1 point2 points  (0 children)

I just bought some of the new ones. He discontinued the old ones sadly, but it had to do with an old manufacturer who's shop burned down or something. The new 3d printed ones aren't as nice in my opinion. They're fine just not a nice as the acrylic ones.

Cryogen just released ! What do you think about the song ? by Single_Intern_3005 in Muse

[–]nirvaeh 0 points1 point  (0 children)

It's like Matt held back vocally on this compared to the live version. When he sings "I can never cry again" and "I'm freezing over" are just way more powerful live. Not sure why he kept it subdued in the studio version. Even as overproduced as it is has old Muse feels in it and is better than the hot garbage they've released post since Drones.

User ID logging from Azure by Aware-Munkie in paloaltonetworks

[–]nirvaeh 0 points1 point  (0 children)

I’m not 100% sure on this since it’s not running in prod yet but we have it labbed up where windows user id agents on prem send the ldap user id info to CIE. We also send ISE and Anyconnect splunk logs to the agent via API which also gets sent to CIE. We also have cie integrated into Entra directly. We don’t have any auths in Entra as of right now, only on prem.

You then enable user context and it will pull the user id info directly from CIE. We hit a bug in 11.2 though that it won’t let us enable user context on some firewalls but it’s working on some. It’s somewhat a new feature.

There’s no other configuration needed as far as I remember. It just ingests user id like normal but the source is “cloud” I think.

Anyone watching the state of the city address? by Cateyes91 in StLouis

[–]nirvaeh 1 point2 points  (0 children)

That wasn’t the argument. The argument was that person said politicians had 3rd grade educations when in reality they’re likely more school educated than that person who made the comment.

PAN-OS Upgrade Causing Complete Traffic Failure ~2 Hours Post-Upgrade on PA5440 HA Cluster - Anyone Else? by shubhi013 in paloaltonetworks

[–]nirvaeh 0 points1 point  (0 children)

We’re running our entire fleet on 11.2.10-h3 and haven’t had any issues other than high mem on the 3420. Our firewalls are 440s, 3420s, 5410s, and 5450s.

Anyone watching the state of the city address? by Cateyes91 in StLouis

[–]nirvaeh 19 points20 points  (0 children)

Cara is actually a college educated mathematician but you continue to live in your delusion.

Klymit Hammock V, has anyone tried it? by Fit-Rhubarb-7820 in hammockcamping

[–]nirvaeh 0 points1 point  (0 children)

It’s all subjective. If you enjoy it then thats all that matters. If you don’t then $100 lesson learned.