WRKLOG-2026-06-08

# Identify affected commits
git log --oneline -- \
  docs/modules/ROOT/pages/2026/03/WRKLOG-2026-03-14.adoc \
  docs/modules/ROOT/pages/2026/04/WRKLOG-2026-04-18.adoc

# 1. BEFORE: Full backup of the repo
cp -a ~/atelier/_bibliotheca/domus-captures ~/atelier/_bibliotheca/domus-captures.bak

# 2. Install git-filter-repo (if not present)
# Arch: pacman -S git-filter-repo
# pip: pip install git-filter-repo

# 3. Create expressions file for replacement
cat > /tmp/scrub-expressions.txt << 'EXPR'
regex:(?i)divorce==[REDACTED]
regex:(?i)dissolutio(?!n\.adoc\.age)==[REDACTED-LEGAL]
regex:(?i)iliana==[REDACTED-NAME]
regex:(?i)angulo-arreola==[REDACTED-NAME]
regex:legal-divorce-notes\.age==legal-notes.age
regex:1099-NEC-iliana==1099-NEC
EXPR

# 4. Verify before (dry run — count matches in history)
git log -p --all -S 'divorce' -- '*.adoc' | grep -c 'divorce' || echo "0 matches"
git log -p --all -S 'iliana' -- '*.adoc' | grep -c 'iliana' || echo "0 matches"

# 5. Run filter-repo (DESTRUCTIVE — rewrites all commit hashes)
git filter-repo --replace-text /tmp/scrub-expressions.txt --force

# 6. Verify after
git log -p --all -S 'divorce' -- '*.adoc' | grep -c 'divorce' || echo "0 matches — CLEAN"
git log -p --all -S 'iliana' -- '*.adoc' | grep -c 'iliana' || echo "0 matches — CLEAN"

# 7. Re-add remotes (filter-repo removes them)
git remote add origin git@github.com:<user>/domus-captures.git
# Add any other remotes (Gitea, etc.)

# 8. Force-push to all remotes (DESTRUCTIVE — overwrites remote history)
git remote | xargs -I{} git push {} main --force

# 9. Clean up
rm /tmp/scrub-expressions.txt
rm -rf ~/atelier/_bibliotheca/domus-captures.bak  # only after verifying

Get-ChildItem Cert:\LocalMachine\My | Format-Table Subject, Issuer, NotBefore, NotAfter, Thumbprint, HasPrivateKey -AutoSize

Get-ChildItem Cert:\LocalMachine\My | Where-Object {
    $_.EnhancedKeyUsageList.ObjectId -contains "1.3.6.1.5.5.7.3.2"
} | Format-List Subject, Issuer, NotBefore, NotAfter, Thumbprint, SerialNumber, @{N='EKU';E={($_.EnhancedKeyUsageList.FriendlyName) -join ", "}}, @{N='Template';E={($_.Extensions | Where-Object {$_.Oid.FriendlyName -eq 'Certificate Template Information'}).Format(0)}}

Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.NotAfter -lt (Get-Date) } | Format-Table Subject, Issuer, NotAfter, Thumbprint -AutoSize

Get-ChildItem Cert:\CurrentUser\My | Format-Table Subject, Issuer, NotBefore, NotAfter, Thumbprint, HasPrivateKey -AutoSize

Get-ChildItem Cert:\CurrentUser\My | Where-Object {
    $_.EnhancedKeyUsageList.ObjectId -contains "1.3.6.1.5.5.7.3.2"
} | Format-List Subject, Issuer, NotBefore, NotAfter, Thumbprint, SerialNumber, @{N='EKU';E={($_.EnhancedKeyUsageList.FriendlyName) -join ", "}}

@("Cert:\CurrentUser\My", "Cert:\LocalMachine\My") | ForEach-Object {
    $store = $_
    Get-ChildItem $store | Where-Object {
        $_.EnhancedKeyUsageList.ObjectId -contains "1.3.6.1.5.5.7.3.2"
    } | Select-Object @{N='Store';E={$store}}, Subject, Issuer, NotAfter, @{N='DaysLeft';E={($_.NotAfter - (Get-Date)).Days}}, Thumbprint
} | Format-Table -AutoSize

Get-ChildItem Cert:\LocalMachine\My | Where-Object {
    $_.EnhancedKeyUsageList.ObjectId -contains "1.3.6.1.5.5.7.3.2"
} | ForEach-Object {
    $chain = New-Object Security.Cryptography.X509Certificates.X509Chain
    $built = $chain.Build($_)
    [PSCustomObject]@{
        Subject = $_.Subject
        Issuer = $_.Issuer
        ChainValid = $built
        ChainStatus = if($built){"OK"}else{($chain.ChainStatus.StatusInformation) -join "; "}
        ChainLength = $chain.ChainElements.Count
    }
} | Format-Table -AutoSize

Get-ChildItem Cert:\LocalMachine\Root | Where-Object {
    $_.Subject -match "CHLA|Intune|SCEP|ISE|DigiCert|Enterprise"
} | Format-Table Subject, NotAfter, Thumbprint -AutoSize

Get-ChildItem Cert:\LocalMachine\CA | Where-Object {
    $_.Subject -match "CHLA|Intune|SCEP|ISE|Enterprise"
} | Format-Table Subject, Issuer, NotAfter, Thumbprint -AutoSize

netsh wlan show profiles

netsh wlan show profile name="CHLA-Staff" key=clear

netsh wlan show profile name="CHLA_Remote" key=clear

netsh wlan show interfaces

foreach ($p in "CHLA_Staff","CHLA-Remote") {
  netsh wlan export profile name="$p" folder=$env:TEMP key=clear > $null

  $f = Get-ChildItem $env:TEMP "Wi-Fi-$p*.xml" |
       Sort-Object LastWriteTime -Descending |
       Select-Object -First 1

  yq -o=json '.' $f.FullName |
    jq '
      def norm:
        walk(
          if type == "object" then
            with_entries(select(.key | startswith("+@") | not)) |
            if has("+content") and (keys | length == 1)
              then .["+content"]
              else .
            end
          else .
          end
        );

      norm
    '

  Remove-Item $f.FullName
}

{
  "+p_xml": "version=\"1.0\"",
  "WLANProfile": {
    "name": "CHLA_Staff",
    "SSIDConfig": {
      "SSID": {
        "hex": "43484C415F5374616666",
        "name": "CHLA_Staff"
      },
      "nonBroadcast": "false"
    },
    "connectionType": "ESS",
    "connectionMode": "auto",
    "autoSwitch": "true",
    "MSM": {
      "security": {
        "authEncryption": {
          "authentication": "WPA2",
          "encryption": "AES",
          "useOneX": "true"
        },
        "PMKCacheMode": "enabled",
        "PMKCacheTTL": "720",
        "PMKCacheSize": "128",
        "preAuthThrottle": "3",
        "OneX": {
          "heldPeriod": "1",
          "authPeriod": "30",
          "startPeriod": "5",
          "maxStart": "5",
          "maxAuthFailures": "5",
          "authMode": "machineOrUser",
          "EAPConfig": {
            "EapHostConfig": {
              "EapMethod": {
                "Type": "55",
                "VendorId": "0",
                "VendorType": "0",
                "AuthorId": "311"
              },
              "Config": {
                "EapTeap": {
                  "ServerValidation": {
                    "TrustedRootCAHash": [
                      "32 eb 83 1e da 15 9 8f fc fb 8f 30 33 4e bf 71 ac 43 ac db fe a8 48 59 d4 ef 74 f8 1 0 4f b4",
                      "d0 38 9b 27 d7 26 97 7f 2f c0 8a 7e af 71 8a bb 5b 9a a6 ac 2f fb 8e e8 68 a8 17 58 5e 29 35 f",
                      "cb 3c cb b7 60 31 e5 e0 13 8f 8d d3 9a 23 f9 de 47 ff c3 5e 43 c1 14 4c ea 27 d4 6a 5a b1 cb 5f",
                      "c0 6e 30 7f 7c fc 1d 32 fa 72 a4 c0 33 c8 7b 90 1 9a f2 16 f0 77 5d 64 97 8a 2e ca 6c 8a 23 e"
                    ],
                    "DisablePrompt": "false",
                    "DownloadTrustedServerRoot": "false"
                  },
                  "Phase2Authentication": {
                    "InnerMethodConfig": [
                      {
                        "EapHostConfig": {
                          "EapMethod": {
                            "Type": "13",
                            "VendorId": "0",
                            "VendorType": "0",
                            "AuthorId": "0"
                          },
                          "Config": {
                            "Eap": {
                              "Type": "13",
                              "EapType": {
                                "CredentialsSource": {
                                  "CertificateStore": {
                                    "SimpleCertSelection": "true"
                                  }
                                },
                                "ServerValidation": {
                                  "DisableUserPromptForServerValidation": "false",
                                  "ServerNames": null,
                                  "TrustedRootCA": [
                                    "1d 6d 28 88 a1 8f 32 96 77 b6 0f a8 31 74 74 c1 69 bc e7 95",
                                    "71 59 9a 14 19 84 7d b0 6b b5 99 36 17 44 0c 06 4e a8 c3 23",
                                    "df 3c 24 f9 bf d6 66 76 1b 26 80 73 fe 06 d1 cc 8d 4f 82 a4",
                                    "8b 3c 5b 9b 86 7d 4b e4 6d 1c b5 a0 1d 45 d6 7d c8 e9 40 82"
                                  ]
                                },
                                "DifferentUsername": "false",
                                "PerformServerValidation": "true",
                                "AcceptServerName": "false",
                                "TLSExtensions": {
                                  "FilteringInfo": {
                                    "ClientAuthEKUList": {}
                                  }
                                }
                              }
                            }
                          }
                        }
                      },
                      {
                        "EapHostConfig": {
                          "EapMethod": {
                            "Type": "13",
                            "VendorId": "0",
                            "VendorType": "0",
                            "AuthorId": "0"
                          },
                          "Config": {
                            "Eap": {
                              "Type": "13",
                              "EapType": {
                                "CredentialsSource": {
                                  "CertificateStore": {
                                    "SimpleCertSelection": "true"
                                  }
                                },
                                "ServerValidation": {
                                  "DisableUserPromptForServerValidation": "false",
                                  "ServerNames": null,
                                  "TrustedRootCA": [
                                    "1d 6d 28 88 a1 8f 32 96 77 b6 0f a8 31 74 74 c1 69 bc e7 95",
                                    "71 59 9a 14 19 84 7d b0 6b b5 99 36 17 44 0c 06 4e a8 c3 23",
                                    "df 3c 24 f9 bf d6 66 76 1b 26 80 73 fe 06 d1 cc 8d 4f 82 a4",
                                    "8b 3c 5b 9b 86 7d 4b e4 6d 1c b5 a0 1d 45 d6 7d c8 e9 40 82"
                                  ]
                                },
                                "DifferentUsername": "false",
                                "PerformServerValidation": "true",
                                "AcceptServerName": "false",
                                "TLSExtensions": {
                                  "FilteringInfo": {
                                    "ClientAuthEKUList": {}
                                  }
                                }
                              }
                            }
                          }
                        }
                      }
                    ]
                  },
                  "Phase1Identity": {
                    "IdentityPrivacy": "true",
                    "AnonymousIdentity": "anonymous"
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}
{
  "+p_xml": "version=\"1.0\"",
  "WLANProfile": {
    "name": "CHLA-Remote",
    "SSIDConfig": {
      "SSID": {
        "hex": "43484C412D52656D6F7465",
        "name": "CHLA-Remote"
      },
      "nonBroadcast": "false"
    },
    "connectionType": "ESS",
    "connectionMode": "auto",
    "autoSwitch": "true",
    "MSM": {
      "security": {
        "authEncryption": {
          "authentication": "WPA2",
          "encryption": "AES",
          "useOneX": "true"
        },
        "PMKCacheMode": "enabled",
        "PMKCacheTTL": "720",
        "PMKCacheSize": "128",
        "preAuthThrottle": "3",
        "OneX": {
          "cacheUserData": "false",
          "heldPeriod": "1",
          "authPeriod": "30",
          "startPeriod": "5",
          "maxStart": "5",
          "maxAuthFailures": "5",
          "authMode": "machineOrUser",
          "EAPConfig": {
            "EapHostConfig": {
              "EapMethod": {
                "Type": "55",
                "VendorId": "0",
                "VendorType": "0",
                "AuthorId": "311"
              },
              "Config": {
                "EapTeap": {
                  "ServerValidation": {
                    "TrustedRootCAHash": [
                      "32 eb 83 1e da 15 9 8f fc fb 8f 30 33 4e bf 71 ac 43 ac db fe a8 48 59 d4 ef 74 f8 1 0 4f b4",
                      "d0 38 9b 27 d7 26 97 7f 2f c0 8a 7e af 71 8a bb 5b 9a a6 ac 2f fb 8e e8 68 a8 17 58 5e 29 35 f",
                      "cb 3c cb b7 60 31 e5 e0 13 8f 8d d3 9a 23 f9 de 47 ff c3 5e 43 c1 14 4c ea 27 d4 6a 5a b1 cb 5f",
                      "c0 6e 30 7f 7c fc 1d 32 fa 72 a4 c0 33 c8 7b 90 1 9a f2 16 f0 77 5d 64 97 8a 2e ca 6c 8a 23 e"
                    ],
                    "DisablePrompt": "false",
                    "DownloadTrustedServerRoot": "false"
                  },
                  "Phase2Authentication": {
                    "InnerMethodConfig": [
                      {
                        "EapHostConfig": {
                          "EapMethod": {
                            "Type": "13",
                            "VendorId": "0",
                            "VendorType": "0",
                            "AuthorId": "0"
                          },
                          "Config": {
                            "Eap": {
                              "Type": "13",
                              "EapType": {
                                "CredentialsSource": {
                                  "CertificateStore": {
                                    "SimpleCertSelection": "true"
                                  }
                                },
                                "ServerValidation": {
                                  "DisableUserPromptForServerValidation": "false",
                                  "ServerNames": null,
                                  "TrustedRootCA": [
                                    "1d 6d 28 88 a1 8f 32 96 77 b6 0f a8 31 74 74 c1 69 bc e7 95",
                                    "71 59 9a 14 19 84 7d b0 6b b5 99 36 17 44 0c 06 4e a8 c3 23",
                                    "df 3c 24 f9 bf d6 66 76 1b 26 80 73 fe 06 d1 cc 8d 4f 82 a4",
                                    "8b 3c 5b 9b 86 7d 4b e4 6d 1c b5 a0 1d 45 d6 7d c8 e9 40 82"
                                  ]
                                },
                                "DifferentUsername": "false",
                                "PerformServerValidation": "true",
                                "AcceptServerName": "false",
                                "TLSExtensions": {
                                  "FilteringInfo": {
                                    "ClientAuthEKUList": {}
                                  }
                                }
                              }
                            }
                          }
                        }
                      },
                      {
                        "EapHostConfig": {
                          "EapMethod": {
                            "Type": "13",
                            "VendorId": "0",
                            "VendorType": "0",
                            "AuthorId": "0"
                          },
                          "Config": {
                            "Eap": {
                              "Type": "13",
                              "EapType": {
                                "CredentialsSource": {
                                  "CertificateStore": {
                                    "SimpleCertSelection": "true"
                                  }
                                },
                                "ServerValidation": {
                                  "DisableUserPromptForServerValidation": "false",
                                  "ServerNames": null,
                                  "TrustedRootCA": [
                                    "1d 6d 28 88 a1 8f 32 96 77 b6 0f a8 31 74 74 c1 69 bc e7 95",
                                    "71 59 9a 14 19 84 7d b0 6b b5 99 36 17 44 0c 06 4e a8 c3 23",
                                    "df 3c 24 f9 bf d6 66 76 1b 26 80 73 fe 06 d1 cc 8d 4f 82 a4",
                                    "8b 3c 5b 9b 86 7d 4b e4 6d 1c b5 a0 1d 45 d6 7d c8 e9 40 82"
                                  ]
                                },
                                "DifferentUsername": "false",
                                "PerformServerValidation": "true",
                                "AcceptServerName": "false",
                                "TLSExtensions": {
                                  "FilteringInfo": {
                                    "ClientAuthEKUList": {}
                                  }
                                }
                              }
                            }
                          }
                        }
                      }
                    ]
                  },
                  "Phase1Identity": {
                    "IdentityPrivacy": "true",
                    "AnonymousIdentity": "anonymous"
                  }
                }
              }
            }
          }
        }
      }
    }
  }

$profiles = foreach ($p in "CHLA_Staff","CHLA-Remote") {
  netsh wlan export profile name="$p" folder=$env:TEMP key=clear > $null
  $f = Get-ChildItem $env:TEMP "Wi-Fi-$p*.xml" | sort LastWriteTime -desc | select -f 1
  yq -o=json '.' $f.FullName
  Remove-Item $f.FullName
}

$profiles | jq -s '
  def norm:
    walk(
      if type == "object" then
        with_entries(select(.key | startswith("+@") | not)) |
        if has("+content") and (keys | length == 1)
          then .["+content"]
          else .
        end
      else .
      end
    );

  map(norm | .WLANProfile)
' | Set-Clipboard

[
  {
    "name": "CHLA_Staff",
    "SSIDConfig": {
      "SSID": {
        "hex": "43484C415F5374616666",
        "name": "CHLA_Staff"
      },
      "nonBroadcast": "false"
    },
    "connectionType": "ESS",
    "connectionMode": "auto",
    "autoSwitch": "true",
    "MSM": {
      "security": {
        "authEncryption": {
          "authentication": "WPA2",
          "encryption": "AES",
          "useOneX": "true"
        },
        "PMKCacheMode": "enabled",
        "PMKCacheTTL": "720",
        "PMKCacheSize": "128",
        "preAuthThrottle": "3",
        "OneX": {
          "heldPeriod": "1",
          "authPeriod": "30",
          "startPeriod": "5",
          "maxStart": "5",
          "maxAuthFailures": "5",
          "authMode": "machineOrUser",
          "EAPConfig": {
            "EapHostConfig": {
              "EapMethod": {
                "Type": "55",
                "VendorId": "0",
                "VendorType": "0",
                "AuthorId": "311"
              },
              "Config": {
                "EapTeap": {
                  "ServerValidation": {
                    "TrustedRootCAHash": [
                      "32 eb 83 1e da 15 9 8f fc fb 8f 30 33 4e bf 71 ac 43 ac db fe a8 48 59 d4 ef 74 f8 1 0 4f b4",
                      "d0 38 9b 27 d7 26 97 7f 2f c0 8a 7e af 71 8a bb 5b 9a a6 ac 2f fb 8e e8 68 a8 17 58 5e 29 35 f",
                      "cb 3c cb b7 60 31 e5 e0 13 8f 8d d3 9a 23 f9 de 47 ff c3 5e 43 c1 14 4c ea 27 d4 6a 5a b1 cb 5f",
                      "c0 6e 30 7f 7c fc 1d 32 fa 72 a4 c0 33 c8 7b 90 1 9a f2 16 f0 77 5d 64 97 8a 2e ca 6c 8a 23 e"
                    ],
                    "DisablePrompt": "false",
                    "DownloadTrustedServerRoot": "false"
                  },
                  "Phase2Authentication": {
                    "InnerMethodConfig": [
                      {
                        "EapHostConfig": {
                          "EapMethod": {
                            "Type": "13",
                            "VendorId": "0",
                            "VendorType": "0",
                            "AuthorId": "0"
                          },
                          "Config": {
                            "Eap": {
                              "Type": "13",
                              "EapType": {
                                "CredentialsSource": {
                                  "CertificateStore": {
                                    "SimpleCertSelection": "true"
                                  }
                                },
                                "ServerValidation": {
                                  "DisableUserPromptForServerValidation": "false",
                                  "ServerNames": null,
                                  "TrustedRootCA": [
                                    "1d 6d 28 88 a1 8f 32 96 77 b6 0f a8 31 74 74 c1 69 bc e7 95",
                                    "71 59 9a 14 19 84 7d b0 6b b5 99 36 17 44 0c 06 4e a8 c3 23",
                                    "df 3c 24 f9 bf d6 66 76 1b 26 80 73 fe 06 d1 cc 8d 4f 82 a4",
                                    "8b 3c 5b 9b 86 7d 4b e4 6d 1c b5 a0 1d 45 d6 7d c8 e9 40 82"
                                  ]
                                },
                                "DifferentUsername": "false",
                                "PerformServerValidation": "true",
                                "AcceptServerName": "false",
                                "TLSExtensions": {
                                  "FilteringInfo": {
                                    "ClientAuthEKUList": {}
                                  }
                                }
                              }
                            }
                          }
                        }
                      },
                      {
                        "EapHostConfig": {
                          "EapMethod": {
                            "Type": "13",
                            "VendorId": "0",
                            "VendorType": "0",
                            "AuthorId": "0"
                          },
                          "Config": {
                            "Eap": {
                              "Type": "13",
                              "EapType": {
                                "CredentialsSource": {
                                  "CertificateStore": {
                                    "SimpleCertSelection": "true"
                                  }
                                },
                                "ServerValidation": {
                                  "DisableUserPromptForServerValidation": "false",
                                  "ServerNames": null,
                                  "TrustedRootCA": [
                                    "1d 6d 28 88 a1 8f 32 96 77 b6 0f a8 31 74 74 c1 69 bc e7 95",
                                    "71 59 9a 14 19 84 7d b0 6b b5 99 36 17 44 0c 06 4e a8 c3 23",
                                    "df 3c 24 f9 bf d6 66 76 1b 26 80 73 fe 06 d1 cc 8d 4f 82 a4",
                                    "8b 3c 5b 9b 86 7d 4b e4 6d 1c b5 a0 1d 45 d6 7d c8 e9 40 82"
                                  ]
                                },
                                "DifferentUsername": "false",
                                "PerformServerValidation": "true",
                                "AcceptServerName": "false",
                                "TLSExtensions": {
                                  "FilteringInfo": {
                                    "ClientAuthEKUList": {}
                                  }
                                }
                              }
                            }
                          }
                        }
                      }
                    ]
                  },
                  "Phase1Identity": {
                    "IdentityPrivacy": "true",
                    "AnonymousIdentity": "anonymous"
                  }
                }
              }
            }
          }
        }
      }
    }
  },
  {
    "name": "CHLA-Remote",
    "SSIDConfig": {
      "SSID": {
        "hex": "43484C412D52656D6F7465",
        "name": "CHLA-Remote"
      },
      "nonBroadcast": "false"
    },
    "connectionType": "ESS",
    "connectionMode": "auto",
    "autoSwitch": "true",
    "MSM": {
      "security": {
        "authEncryption": {
          "authentication": "WPA2",
          "encryption": "AES",
          "useOneX": "true"
        },
        "PMKCacheMode": "enabled",
        "PMKCacheTTL": "720",
        "PMKCacheSize": "128",
        "preAuthThrottle": "3",
        "OneX": {
          "cacheUserData": "false",
          "heldPeriod": "1",
          "authPeriod": "30",
          "startPeriod": "5",
          "maxStart": "5",
          "maxAuthFailures": "5",
          "authMode": "machineOrUser",
          "EAPConfig": {
            "EapHostConfig": {
              "EapMethod": {
                "Type": "55",
                "VendorId": "0",
                "VendorType": "0",
                "AuthorId": "311"
              },
              "Config": {
                "EapTeap": {
                  "ServerValidation": {
                    "TrustedRootCAHash": [
                      "32 eb 83 1e da 15 9 8f fc fb 8f 30 33 4e bf 71 ac 43 ac db fe a8 48 59 d4 ef 74 f8 1 0 4f b4",
                      "d0 38 9b 27 d7 26 97 7f 2f c0 8a 7e af 71 8a bb 5b 9a a6 ac 2f fb 8e e8 68 a8 17 58 5e 29 35 f",
                      "cb 3c cb b7 60 31 e5 e0 13 8f 8d d3 9a 23 f9 de 47 ff c3 5e 43 c1 14 4c ea 27 d4 6a 5a b1 cb 5f",
                      "c0 6e 30 7f 7c fc 1d 32 fa 72 a4 c0 33 c8 7b 90 1 9a f2 16 f0 77 5d 64 97 8a 2e ca 6c 8a 23 e"
                    ],
                    "DisablePrompt": "false",
                    "DownloadTrustedServerRoot": "false"
                  },
                  "Phase2Authentication": {
                    "InnerMethodConfig": [
                      {
                        "EapHostConfig": {
                          "EapMethod": {
                            "Type": "13",
                            "VendorId": "0",
                            "VendorType": "0",
                            "AuthorId": "0"
                          },
                          "Config": {
                            "Eap": {
                              "Type": "13",
                              "EapType": {
                                "CredentialsSource": {
                                  "CertificateStore": {
                                    "SimpleCertSelection": "true"
                                  }
                                },
                                "ServerValidation": {
                                  "DisableUserPromptForServerValidation": "false",
                                  "ServerNames": null,
                                  "TrustedRootCA": [
                                    "1d 6d 28 88 a1 8f 32 96 77 b6 0f a8 31 74 74 c1 69 bc e7 95",
                                    "71 59 9a 14 19 84 7d b0 6b b5 99 36 17 44 0c 06 4e a8 c3 23",
                                    "df 3c 24 f9 bf d6 66 76 1b 26 80 73 fe 06 d1 cc 8d 4f 82 a4",
                                    "8b 3c 5b 9b 86 7d 4b e4 6d 1c b5 a0 1d 45 d6 7d c8 e9 40 82"
                                  ]
                                },
                                "DifferentUsername": "false",
                                "PerformServerValidation": "true",
                                "AcceptServerName": "false",
                                "TLSExtensions": {
                                  "FilteringInfo": {
                                    "ClientAuthEKUList": {}
                                  }
                                }
                              }
                            }
                          }
                        }
                      },
                      {
                        "EapHostConfig": {
                          "EapMethod": {
                            "Type": "13",
                            "VendorId": "0",
                            "VendorType": "0",
                            "AuthorId": "0"
                          },
                          "Config": {
                            "Eap": {
                              "Type": "13",
                              "EapType": {
                                "CredentialsSource": {
                                  "CertificateStore": {
                                    "SimpleCertSelection": "true"
                                  }
                                },
                                "ServerValidation": {
                                  "DisableUserPromptForServerValidation": "false",
                                  "ServerNames": null,
                                  "TrustedRootCA": [
                                    "1d 6d 28 88 a1 8f 32 96 77 b6 0f a8 31 74 74 c1 69 bc e7 95",
                                    "71 59 9a 14 19 84 7d b0 6b b5 99 36 17 44 0c 06 4e a8 c3 23",
                                    "df 3c 24 f9 bf d6 66 76 1b 26 80 73 fe 06 d1 cc 8d 4f 82 a4",
                                    "8b 3c 5b 9b 86 7d 4b e4 6d 1c b5 a0 1d 45 d6 7d c8 e9 40 82"
                                  ]
                                },
                                "DifferentUsername": "false",
                                "PerformServerValidation": "true",
                                "AcceptServerName": "false",
                                "TLSExtensions": {
                                  "FilteringInfo": {
                                    "ClientAuthEKUList": {}
                                  }
                                }
                              }
                            }
                          }
                        }
                      }
                    ]
                  },
                  "Phase1Identity": {
                    "IdentityPrivacy": "true",
                    "AnonymousIdentity": "anonymous"
                  }
                }
              }
            }
          }
        }
      }
    }
  }
]

mkdir C:\temp -ErrorAction SilentlyContinue
netsh wlan export profile name="CHLA-Staff" folder=C:\temp key=clear
netsh wlan export profile name="CHLA_Remote" folder=C:\temp key=clear
dir C:\temp\*CHLA*

[xml]$profile = Get-Content "C:\temp\Wi-Fi-CHLA-Staff.xml"

Write-Host "=== Connection Settings ==="
Write-Host "SSID:       $($profile.WLANProfile.SSIDConfig.SSID.name)"
Write-Host "Auth:       $($profile.WLANProfile.MSM.security.authEncryption.authentication)"
Write-Host "Encryption: $($profile.WLANProfile.MSM.security.authEncryption.encryption)"
Write-Host "802.1X:     $($profile.WLANProfile.MSM.security.OneX.authMode)"

$eapType = $profile.WLANProfile.MSM.security.OneX.EAPConfig.EapHostConfig.EapMethod.Type.'#text'
Write-Host "EAP Type:   $eapType (13=TLS, 25=PEAP, 21=TTLS)"

Write-Host "`n=== Certificate Config ==="
$profile.WLANProfile.MSM.security.OneX.EAPConfig.EapHostConfig | Select-Xml -XPath "//*[local-name()='ServerValidation']" | ForEach-Object { $_.Node.OuterXml }
$profile.WLANProfile.MSM.security.OneX.EAPConfig.EapHostConfig | Select-Xml -XPath "//*[local-name()='TLSExtensions']" | ForEach-Object { $_.Node.OuterXml }

Compare-Object (Get-Content "C:\temp\Wi-Fi-CHLA-Staff.xml") (Get-Content "C:\temp\Wi-Fi-CHLA_Remote.xml")

Get-ChildItem "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Wireless\GPTWirelessPolicy" -Recurse -ErrorAction SilentlyContinue | Format-List

Get-ChildItem "HKLM:\SOFTWARE\Microsoft\WlanSvc\Profiles" -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
    $props = Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue
    if($props) { [PSCustomObject]@{Path=$_.PSPath; Props=($props.PSObject.Properties | Where-Object {$_.Name -notmatch 'PS'} | ForEach-Object {"$($_.Name)=$($_.Value)"}) -join "; "} }
} | Format-List

dsregcmd /status | Select-String -Pattern "AzureAd|Domain|MDM|Tenant|Device"

Get-WinEvent -FilterHashtable @{
    LogName='Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin'
    StartTime=(Get-Date).AddDays(-7)
} -ErrorAction SilentlyContinue | Where-Object {
    $_.Message -match "WiFi|WLAN|CHLA-Staff|CHLA.Remote|CHLA_Remote|wireless|profile"
} | Format-Table TimeCreated, Id, @{N='Message';E={$_.Message.Substring(0,[Math]::Min(250,$_.Message.Length))}} -Wrap

Get-WinEvent -FilterHashtable @{
    LogName='Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin'
    StartTime=(Get-Date).AddDays(-7)
} -ErrorAction SilentlyContinue | Where-Object {
    $_.Id -in @(800,801,802,803,804,805,806,807,808,809,810,811,812,813,814,815)
} | Select-Object TimeCreated, Id, @{N='Message';E={$_.Message.Substring(0,[Math]::Min(250,$_.Message.Length))}} | Format-Table -Wrap

# Registry path where Intune WiFi profiles land
Get-ChildItem "HKLM:\SOFTWARE\Microsoft\WlanSvc\Profiles\*" -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
    $xml = (Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue).ProfileXml
    if($xml -match "CHLA") {
        Write-Host "=== $($_.PSPath) ==="
        # Parse the XML to extract SSID and auth settings
        [xml]$p = $xml
        Write-Host "SSID:    $($p.WLANProfile.SSIDConfig.SSID.name)"
        Write-Host "Auth:    $($p.WLANProfile.MSM.security.authEncryption.authentication)"
        Write-Host "EAP:     $($p.WLANProfile.MSM.security.OneX.EAPConfig.EapHostConfig.EapMethod.Type.'#text')"
        Write-Host "Source:  MDM/Intune"
        Write-Host ""
    }
}

Write-Host "=== GPO WiFi Profiles ==="
Get-ChildItem "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Wireless\GPTWirelessPolicy" -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
    $props = Get-ItemProperty $_.PSPath -ErrorAction SilentlyContinue
    if($props.ProfileName) { Write-Host "  GPO: $($props.ProfileName)" }
}

Write-Host "`n=== Intune/MDM WiFi Profiles ==="
netsh wlan show profiles | Select-String "CHLA" | ForEach-Object {
    $name = ($_ -split ":\s+")[1].Trim()
    $detail = netsh wlan show profile name="$name" | Select-String "Applied From"
    Write-Host "  $name — $detail"
}

Write-Host "`n=== All Profile Sources ==="
netsh wlan show profiles | Select-String "All User" | ForEach-Object {
    $name = ($_ -split ":\s+")[1].Trim()
    Write-Host "  $name"
}

Get-WinEvent -FilterHashtable @{
    LogName='Microsoft-Windows-WLAN-AutoConfig/Operational'
    StartTime=(Get-Date).AddDays(-1)
} -ErrorAction SilentlyContinue | Where-Object {
    $_.Message -match "CHLA-Staff|CHLA.Remote|CHLA_Remote"
} | Format-Table TimeCreated, Id, @{N='Message';E={$_.Message.Substring(0,[Math]::Min(250,$_.Message.Length))}} -Wrap

Get-WinEvent -FilterHashtable @{
    LogName='Microsoft-Windows-WLAN-AutoConfig/Operational'
    Id=@(8001,8002,8003,8004,11001,11002,11004,11005,11010,11011)
    StartTime=(Get-Date).AddDays(-1)
} -ErrorAction SilentlyContinue | Select-Object TimeCreated, Id, @{N='Event';E={
    switch($_.Id){
        8001{"Connected"}; 8002{"Connect failed"}; 8003{"Disconnected"}; 8004{"Profile changed"}
        11001{"Auth started"}; 11002{"Auth succeeded"}; 11004{"Auth failed"}; 11005{"Auth rejected"}
        11010{"Cert selected"}; 11011{"Cert rejected"}
    }
}}, @{N='Detail';E={$_.Message.Substring(0,[Math]::Min(150,$_.Message.Length))}} | Format-Table -Wrap

# Pane 1 (left, large): SSH to CHLXSYSLOG01
ssh erosado@10.248.13.254

# Pane 2 (top right): this file as reference
bat docs/modules/ROOT/partials/worklog/daily-notes/2026-06-08/rsyslog-asa-troubleshooting.adoc

# Pane 3 (bottom right): ISE queries from workstation
dsource d001 dev/network/ise

# If hostname is in SSH config:
ssh rsyslog-01

# If not — direct:
ssh <username>@<rsyslog-server-ip>

# If you need to go through a jump host:
ssh -J <jumphost> <username>@<rsyslog-server-ip>

# System summary — one shot
hostnamectl | awk '/hostname|Operating|Kernel|Virtualization/{print}'

# Who am I and what can I sudo?
id | awk -F'[()]' '{for(i=2;i<=NF;i+=2) printf "%s\n", $i}' | head -5
sudo -l

# Disk — formatted, only what matters
df -h /var /home /boot | awk 'NR==1 || /mapper|sda/{printf "%-45s %5s %5s %4s\n", $1, $2, $4, $5}'

# Log volume
du -sh /var/log 2>/dev/null

# Network — IPs and listeners
ip -br addr | awk '/UP/{print}'
ss -tulnp | awk 'NR==1 || /514|syslog/'

# Is rsyslog running? One-liner status
systemctl is-active rsyslog && echo "PID: $(pgrep rsyslogd)"

# Version — determines config syntax (v8+ uses RainerScript)
/usr/sbin/rsyslogd -v 2>/dev/null || rsyslogd -v

# Config files — what exists?
ls -la /etc/rsyslog.conf /etc/rsyslog.d/

# Full config — strip comments, show only active lines
sudo awk '/^[^#]/ && NF' /etc/rsyslog.conf

# All drop-in configs
for f in /etc/rsyslog.d/*.conf; do echo "=== $f ==="; sudo awk '/^[^#]/ && NF' "$f"; echo; done

# Recent syslog entries
sudo tail -50 /var/log/syslog

# Any ASA messages already?
sudo grep -c '%ASA' /var/log/syslog && echo "ASA logs found" || echo "NO ASA logs yet"

# Log rotation config
cat /etc/logrotate.d/rsyslog

# Unique source hosts with message counts — dashboard view
sudo awk '{print $4}' /var/log/syslog | sort | uniq -c | sort -rn | head -20

# Source IPs from recent messages
sudo awk '/from /{match($0,/[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+/); if(RSTART) print substr($0,RSTART,RLENGTH)}' /var/log/syslog | sort | uniq -c | sort -rn | head -20

d001 open siem-qradar
bat data/d001/projects/siem-qradar-to-sentinel/partials/rsyslog-central-collector.adoc

show logging
show logging setting
show running-config logging

logging enable
logging timestamp
logging host <interface> <rsyslog-ip> [tcp|udp]/<port>
logging trap <level>         ! informational (6) or debugging (7) for full capture
logging facility <number>    ! default 20 (local4)

logging enable
logging timestamp
logging host management <rsyslog-ip> udp/514
logging trap informational
logging facility 20

ss -ulnp | grep 514
ss -tlnp | grep 514

grep -rn 'imudp\|imtcp\|514' /etc/rsyslog.conf /etc/rsyslog.d/

# /etc/rsyslog.conf or /etc/rsyslog.d/00-input.conf
module(load="imudp")
input(type="imudp" port="514")

# For TCP (more reliable):
module(load="imtcp")
input(type="imtcp" port="514")

sudo systemctl restart rsyslog
sudo systemctl status rsyslog
ss -ulnp | grep 514

# Quick packet capture on port 514
sudo tcpdump -i any port 514 -nn -c 20

# More detail — show payload
sudo tcpdump -i any port 514 -nn -A -c 10

# Send test message to rsyslog
echo "<14>Test from workstation $(date)" | nc -u -w1 <rsyslog-ip> 514

! Generate a syslog event
logging message 199999 level 6
! Or just make a config change and revert — it logs

# Default syslog
tail -f /var/log/syslog | grep -i asa

# Or messages
tail -f /var/log/messages | grep -i asa

# If you configured a dedicated ASA log file
tail -f /var/log/asa/asa.log

grep '<asa-ip>' /var/log/syslog | tail -20

sudo iptables -L -n | grep 514
sudo nft list ruleset | grep 514

sudo firewall-cmd --list-all | grep 514
# If not open:
sudo firewall-cmd --add-port=514/udp --permanent
sudo firewall-cmd --add-port=514/tcp --permanent
sudo firewall-cmd --reload

# On VyOS — check if syslog port is allowed between zones
show firewall statistics

# /etc/rsyslog.d/10-asa.conf
template(name="AsaFile" type="string"
    string="/var/log/asa/%HOSTNAME%/%$YEAR%-%$MONTH%-%$DAY%.log")

if $fromhost-ip == '<asa-ip>' then {
    action(type="omfile" dynaFile="AsaFile")
    stop
}

# Count messages by ASA message ID
sudo grep -oP '%ASA-\d-\d+' /var/log/syslog | sort | uniq -c | sort -rn | head -20

# By severity level
sudo awk '/%ASA/{match($0,/%ASA-([0-9])/,a); sev[a[1]]++} END{for(s in sev) printf "Level %s: %d\n", s, sev[s]}' /var/log/syslog | sort

sudo tcpdump -i any port 514 -nn -c 10

sudo tail -20 /var/log/syslog

sudo grep '%ASA' /var/log/syslog | tail -20

sudo journalctl -u rsyslog --since "5 min ago" --no-pager

# Check what rsyslog is doing with incoming UDP
sudo awk '/^[^#]/ && NF' /etc/rsyslog.conf | head -40

# Check if imudp module is loaded
sudo awk '/imudp|imtcp|514/' /etc/rsyslog.conf /etc/rsyslog.d/*.conf 2>/dev/null

# Check rsyslog internal stats
sudo rsyslogd -N1 2>&1 | head -20

# What's your IP?
ip -br addr | awk '/UP/{print}'

# Can you reach the ASA from here?
ping -c 2 172.16.57.177 2>/dev/null || echo "Cannot reach internal syslog server"

# Check local firewall on this Debian box
sudo iptables -L -n 2>/dev/null | grep -i '514\|syslog\|ACCEPT\|DROP'
sudo nft list ruleset 2>/dev/null | grep 514

# How many ASA messages right now?
sudo grep -c '%ASA' /var/log/syslog

# Messages per source device
sudo awk '/%ASA/{match($0,/from ([0-9.]+)/,a); if(a[1]) src[a[1]]++} END{for(s in src) printf "%6d %s\n", src[s], s}' /var/log/syslog | sort -rn

# Last 10 messages — formatted
sudo grep '%ASA' /var/log/syslog | tail -10 | awk '{match($0,/%ASA-[0-9]-[0-9]+/); printf "%-18s %-16s\n", $1" "$2" "$3, substr($0,RSTART,RLENGTH)}'

# Live tail — ASA only
sudo tail -f /var/log/syslog | awk '/%ASA/'

sudo tail -f /var/log/syslog | awk '/%ASA/{match($0,/%ASA-[0-9]-[0-9]+/); id=substr($0,RSTART,RLENGTH); count[id]++; printf "\r%s: %d  ", id, count[id]}'

sudo tail -f /var/log/syslog | awk '/%ASA/{
  match($0,/%ASA-[0-9]-[0-9]+/);
  id=substr($0,RSTART,RLENGTH);
  ts=$1" "$2" "$3;
  printf "%-18s %-16s %s\n", ts, id, substr($0,RSTART+RLENGTH+2,80)
}'

sudo tcpdump -i any port 514 -nn -l 2>/dev/null | awk '{
  match($0,/[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+/);
  ip=substr($0,RSTART,RLENGTH);
  count[ip]++;
  printf "\r";
  for(i in count) printf "%s: %d  ", i, count[i]
}'

sudo awk '/%ASA/{print $1, $2, $3}' /var/log/syslog | awk '{print $1, $2, substr($3,1,5)}' | sort | uniq -c | tail -10

%ASA-4-106023  — Deny by ACL (firewall drops)
%ASA-6-302013  — Built TCP connection
%ASA-6-302014  — Teardown TCP connection
%ASA-6-302015  — Built UDP connection
%ASA-6-302016  — Teardown UDP connection
%ASA-4-733100  — Threat detection (scanning, DoS)
%ASA-5-111008  — User executed command (admin activity)
%ASA-6-605005  — Login permitted (admin login)
%ASA-3-710003  — Deny TCP connection (management ACL)

# Get the message trace ID
$trace = Get-MessageTrace -SenderAddress "dccs@dccsconsulting.com" -RecipientAddress "erosado@chla.usc.edu" -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date)
$trace | Format-List MessageTraceId, Received, Status, Subject

# Get detailed events — look for the override
Get-MessageTraceDetail -MessageTraceId $trace.MessageTraceId -RecipientAddress "erosado@chla.usc.edu" | Format-List Date, Event, Action, Detail, Data

# Same for wcox
$trace2 = Get-MessageTrace -SenderAddress "dccs@dccsconsulting.com" -RecipientAddress "wcox@chla.usc.edu" -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date)
Get-MessageTraceDetail -MessageTraceId $trace2.MessageTraceId -RecipientAddress "wcox@chla.usc.edu" | Format-List Date, Event, Action, Detail, Data

# Control — csandoval (should show filtered)
$trace3 = Get-MessageTrace -SenderAddress "dccs@dccsconsulting.com" -RecipientAddress "csandoval@chla.usc.edu" -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date)
if ($trace3) { Get-MessageTraceDetail -MessageTraceId $trace3.MessageTraceId -RecipientAddress "csandoval@chla.usc.edu" | Format-List Date, Event, Action, Detail, Data }

# Connect to Exchange Online (if not already)
Connect-ExchangeOnline

# Affected users — compare settings
Get-MailboxJunkEmailConfiguration "erosado@chla.usc.edu" | Format-List Enabled, TrustedSendersAndDomains, BlockedSendersAndDomains, ContactsTrusted, TrustedListsOnly
Get-MailboxJunkEmailConfiguration "wcox@chla.usc.edu" | Format-List Enabled, TrustedSendersAndDomains, BlockedSendersAndDomains, ContactsTrusted, TrustedListsOnly

# Control — not affected
Get-MailboxJunkEmailConfiguration "csandoval@chla.usc.edu" | Format-List Enabled, TrustedSendersAndDomains, BlockedSendersAndDomains, ContactsTrusted, TrustedListsOnly

Enabled: False         ← PROBLEM: junk mail processing disabled entirely
ContactsTrusted: True  ← PROBLEM: all contacts auto-whitelisted
TrustedSendersAndDomains contains "dccsconsulting.com" or "dccs@dccsconsulting.com"
                       ← PROBLEM: sender explicitly whitelisted — THIS IS THE MOST LIKELY CAUSE

# Full safe sender list — erosado
(Get-MailboxJunkEmailConfiguration "erosado@chla.usc.edu").TrustedSendersAndDomains | Sort-Object

# Full safe sender list — wcox
(Get-MailboxJunkEmailConfiguration "wcox@chla.usc.edu").TrustedSendersAndDomains | Sort-Object

# Search specifically for the offending domain
(Get-MailboxJunkEmailConfiguration "erosado@chla.usc.edu").TrustedSendersAndDomains | Where-Object { $_ -like "*dccsconsulting*" }
(Get-MailboxJunkEmailConfiguration "wcox@chla.usc.edu").TrustedSendersAndDomains | Where-Object { $_ -like "*dccsconsulting*" }

# Control — csandoval should NOT have it
(Get-MailboxJunkEmailConfiguration "csandoval@chla.usc.edu").TrustedSendersAndDomains | Where-Object { $_ -like "*dccsconsulting*" }

@("erosado", "wcox", "csandoval") | ForEach-Object {
    $config = Get-MailboxJunkEmailConfiguration "$_@chla.usc.edu"
    [PSCustomObject]@{
        User = $_
        Enabled = $config.Enabled
        ContactsTrusted = $config.ContactsTrusted
        TrustedCount = $config.TrustedSendersAndDomains.Count
        BlockedCount = $config.BlockedSendersAndDomains.Count
    }
} | Format-Table -AutoSize

# WARNING: slow on large orgs — run during off-hours or limit scope
Get-Mailbox -ResultSize Unlimited | ForEach-Object {
    $junk = Get-MailboxJunkEmailConfiguration $_.PrimarySmtpAddress -ErrorAction SilentlyContinue
    if ($junk.TrustedSendersAndDomains -like "*dccsconsulting*") {
        [PSCustomObject]@{
            User = $_.PrimarySmtpAddress
            Match = ($junk.TrustedSendersAndDomains | Where-Object { $_ -like "*dccsconsulting*" })
        }
    }
} | Format-Table -AutoSize

# Remove specific sender from safe list — erosado
Set-MailboxJunkEmailConfiguration "erosado@chla.usc.edu" -TrustedSendersAndDomains @{Remove="dccs@dccsconsulting.com"}
Set-MailboxJunkEmailConfiguration "erosado@chla.usc.edu" -TrustedSendersAndDomains @{Remove="dccsconsulting.com"}

# Remove specific sender from safe list — wcox
Set-MailboxJunkEmailConfiguration "wcox@chla.usc.edu" -TrustedSendersAndDomains @{Remove="dccs@dccsconsulting.com"}
Set-MailboxJunkEmailConfiguration "wcox@chla.usc.edu" -TrustedSendersAndDomains @{Remove="dccsconsulting.com"}

# Verify removal
(Get-MailboxJunkEmailConfiguration "erosado@chla.usc.edu").TrustedSendersAndDomains | Where-Object { $_ -like "*dccsconsulting*" }
(Get-MailboxJunkEmailConfiguration "wcox@chla.usc.edu").TrustedSendersAndDomains | Where-Object { $_ -like "*dccsconsulting*" }

# Check inbox rules for erosado — look for rules moving spam to inbox or auto-forwarding
Get-InboxRule -Mailbox "erosado@chla.usc.edu" | Format-List Name, Enabled, Description, MoveToFolder, ForwardTo, RedirectTo, MarkAsRead, StopProcessingRules

# Check inbox rules for wcox
Get-InboxRule -Mailbox "wcox@chla.usc.edu" | Format-List Name, Enabled, Description, MoveToFolder, ForwardTo, RedirectTo, MarkAsRead, StopProcessingRules

# Look for rules that match the sender domain
Get-InboxRule -Mailbox "erosado@chla.usc.edu" | Where-Object { $_.Description -like "*dccsconsulting*" -or $_.FromAddressContainsWords -like "*dccs*" }
Get-InboxRule -Mailbox "wcox@chla.usc.edu" | Where-Object { $_.Description -like "*dccsconsulting*" -or $_.FromAddressContainsWords -like "*dccs*" }

# Check if policies allow user overrides (safe sender lists)
Get-HostedContentFilterPolicy | Format-List Name, AllowedSenders, AllowedSenderDomains, EnableUserOverrides

# If EnableUserOverrides is True — users CAN whitelist senders that override SCL verdicts
# To PREVENT users from overriding high-confidence spam:
# Set-HostedContentFilterPolicy -Identity "Default" -EnableUserOverrides $false
# WARNING: org-wide impact — discuss with team before applying

# Trace for affected users
Get-MessageTrace -SenderAddress "dccs@dccsconsulting.com" -RecipientAddress "erosado@chla.usc.edu" -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) | Format-List Received, Subject, Status, ToIP, FromIP, Size, MessageTraceId

Get-MessageTrace -SenderAddress "dccs@dccsconsulting.com" -RecipientAddress "wcox@chla.usc.edu" -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) | Format-List Received, Subject, Status, ToIP, FromIP, Size, MessageTraceId

# Control — should show FilteredAsSpam or similar
Get-MessageTrace -SenderAddress "dccs@dccsconsulting.com" -RecipientAddress "csandoval@chla.usc.edu" -StartDate (Get-Date).AddDays(-7) -EndDate (Get-Date) | Format-List Received, Subject, Status, ToIP, FromIP, Size, MessageTraceId

# Get MessageTraceId from above, then:
$traceId = "<MessageTraceId from erosado trace>"
Get-MessageTraceDetail -MessageTraceId $traceId -RecipientAddress "erosado@chla.usc.edu" | Format-List Date, Event, Action, Detail, Data

# All content filter policies
Get-HostedContentFilterPolicy | Format-List Name, SpamAction, HighConfidenceSpamAction, BulkSpamAction, BulkThreshold, PhishSpamAction, HighConfidencePhishAction, IsDefault

# All content filter rules (who gets which policy)
Get-HostedContentFilterRule | Format-List Name, HostedContentFilterPolicy, SentTo, SentToMemberOf, RecipientDomainIs, Priority, State

HighConfidenceSpamAction: MoveToJmf or Quarantine  ← correct
HighConfidenceSpamAction: NoAction or Redirect      ← PROBLEM

# Check if affected users are excluded from a stricter policy
# or covered by a permissive one

# Find any rule that sets SCL to -1 (bypass spam filtering)
Get-TransportRule | Where-Object { $_.SetSCL -eq -1 } | Format-List Name, State, Priority, Conditions, FromAddressContainsWords, SenderDomainIs

# Broader — any rule touching SCL
Get-TransportRule | Where-Object { $_.SetSCL -ne $null } | Format-List Name, SetSCL, State, Conditions

# Full dump of all active transport rules (look for sender/domain matches)
Get-TransportRule | Where-Object { $_.State -eq 'Enabled' } | Format-List Name, Priority, Conditions, Actions, SetSCL

Get-HostedConnectionFilterPolicy | Format-List Name, IPAllowList, IPBlockList, EnableSafeList

# Check if sender or domain is in tenant allow list
Get-TenantAllowBlockListItems -ListType Sender | Where-Object { $_.Value -like "*dccsconsulting*" } | Format-List Value, Action, ExpirationDate, Notes

# Also check URL list (sometimes domains end up here)
Get-TenantAllowBlockListItems -ListType Url | Where-Object { $_.Value -like "*dccsconsulting*" }

# In Abnormal Security console:
# Search → dccs@dccsconsulting.com
# Check: Was it analyzed? Was it flagged? Did Abnormal remediate?
# If Abnormal is in read-only mode, it may have detected but not acted.

# If junk mail is disabled on affected mailboxes — re-enable:
Set-MailboxJunkEmailConfiguration "erosado@chla.usc.edu" -Enabled $true
Set-MailboxJunkEmailConfiguration "wcox@chla.usc.edu" -Enabled $true

# If sender is in safe sender list — remove:
# (Get specific list first, then remove the entry)

# Block the sender immediately at tenant level:
New-TenantAllowBlockListItems -ListType Sender -Entries "dccs@dccsconsulting.com" -Block -NoExpiration -Notes "SCL 9 spam delivered to inbox — investigation 2026-06-08"

gh repo list --limit 100 --json name,description \
  | jq -r '.[] | select(.name | test("domus|antora|asciidoc"; "i")) | "\(.name)\t\(.description)"'

gh repo list --limit 100 --json name,description,updatedAt \
  | jq -r 'sort_by(.updatedAt) | reverse | .[:20] | .[] | "\(.updatedAt[:10])\t\(.name)\t\(.description)"'

gh repo list --limit 100 --json name,diskUsage \
  | jq -r '.[] | "\(.diskUsage)\t\(.name)"' | sort -rn | head -10

gh repo clone EvanusModestus/<repo-name> ~/atelier/_bibliotheca/<repo-name>

find docs/modules/ROOT/examples/codex/powershell -type f -name "*.adoc" \
  -exec grep -l 'Get-Process\|Start-Process\|pipeline\|Where-Object' {} \;

find docs/modules/ROOT -name "powershell" -type d \
  -exec sh -c 'echo "$1: $(find "$1" -type f | wc -l) files"' _ {} \;

for f in $(find docs/modules/ROOT/examples/codex/powershell -name "*.adoc" -type f); do
  base=$(basename "$f")
  dir_parent=$(basename $(dirname "$f"))
  grep -rq "$dir_parent/$base" docs/modules/ROOT/pages/codex/powershell/ \
    docs/modules/ROOT/examples/codex/powershell/*.adoc 2>/dev/null \
    || echo "ORPHAN: $f"
done

nvim $(find -path '*oauth*' -name '*.adoc' -type f \
  -exec grep -l 'timeout\|expire\|reconfig\|token' {} \;)

nvim $(find docs/modules/ROOT -name '*.adoc' -type f \
  -exec grep -l 'token.*expire\|oauth.*refresh' {} \;)

find -path '*oauth*' -name '*.adoc' -type f \
  -exec grep -l 'timeout\|expire' {} \; \
  -exec nvim {} \;

grep -rl 'commands/shell' docs/modules/ROOT/partials/

grep -rl 'quick-commands' docs/modules/ROOT | wc -l

file="commands/shell"
grep -rl "$file" docs/modules/ROOT/partials/ | while read f; do
  parent=$(basename "$f" .adoc)
  echo "$file -> $parent"
  grep -rl "$parent" docs/modules/ROOT/pages/ | while read p; do
    echo "  -> $(basename "$p")"
  done
done

find docs/modules/ROOT -name "*urgent.adoc*" -type f
find docs/modules/ROOT -name "*morning.adoc*" -type f

find docs/modules/ROOT -type f -regextype posix-extended \
  -regex '.*(urgent|morning|work-chla|personal|education|infrastructure|quick-commands|related)\.adoc' \
  | sort

find docs/modules/ROOT -type f -name "*.adoc" \
  | grep -E 'urgent|morning|work-chla|personal|education|infrastructure|quick-commands|related'

grep -rn --include='*.adoc' -c 'sanchuelo' . | grep -v ':0$'

grep -rl --include='*.adoc' -i 'sanchuelo' ~/atelier/_bibliotheca/ | sort

grep -rn --include='*.adoc' -i -B1 -A1 'sanchuelo' ~/atelier/_bibliotheca/domus-captures/

grep -rl -i 'sanchuelo' ~/atelier/_bibliotheca/ --include='*.txt' --include='*.adoc' | sort

find ~/atelier/_bibliotheca/ -type f \( -name '*.adoc' -o -name '*.txt' \) -print0 \
  | xargs -0 grep -li 'sanchuelo' | sort

grep -rl -i 'sanchuelo' ~/atelier/_bibliotheca/ --include='*.adoc' --include='*.txt' | xargs nvim

grep -P '(@\w+|^From:.*<)' comms.adoc

grep -nP '\d{1,2}/\d{1,2}/\d{2,4}|20\d{2}-\d{2}-\d{2}' comms.adoc

grep -niP '(I can |I will |I.ll |we will |we.ll )' comms.adoc

grep -niP '(\?|need to confirm|need to validate|TBD|pending)' comms.adoc

# All recipients
grep -oP '<\K[^>]+' comms.adoc | sort -u > /tmp/all-recipients

# All senders
grep -P '^From:' comms.adoc | grep -oP '<\K[^>]+' | sort -u > /tmp/replied

# Who's silent — follow-up targets
comm -23 /tmp/all-recipients /tmp/replied

# Sort by mtime, strip epoch prefix — handles spaces in filenames
find ~/Downloads -maxdepth 1 -name '*.pdf' -printf '%T@ %p\n' | sort -rn | awk '{sub(/^[^ ]+ /,""); print}'

# ISO 8601 timestamps — readable and lexicographically sortable
find ~/Downloads -maxdepth 1 -name '*.pdf' -printf '%T+ %p\n' | sort -r | head -20

# Null-delimited: survives any filename (newlines, quotes, unicode)
find ~/Downloads -maxdepth 1 -name '*.pdf' -printf '%T@\t%p\0' | sort -zrn | awk -v RS='\0' -F'\t' '{print $2}'

# GNU stat equivalent — works where -printf is unavailable
find ~/Downloads -maxdepth 1 -name '*latin*' -exec stat --format='%Y %n' {} + | sort -rn | awk '{sub(/^[^ ]+ /,""); print}'

# Size in bytes (-printf %s), human-readable via numfmt
find ~/Downloads -type f -printf '%s\t%p\n' | sort -rn | head -10 | numfmt --to=iec --field=1

# Files sharing a byte count — likely duplicates (confirm with md5sum)
find ~/Downloads -type f -printf '%s %p\n' | awk '{seen[$1]++; files[$1]=files[$1] "\n  " $0} END {for (s in seen) if (seen[s]>1) print files[s]}'

# md5sum only files with duplicate sizes (two-pass: fast then precise)
find ~/Downloads -type f -printf '%s\n' | sort | uniq -d | while read -r size; do
  find ~/Downloads -type f -size "${size}c" -exec md5sum {} +
done | sort | uniq -w32 -D

# Count files by MIME type (not extension — extensions lie)
find ~/Downloads -type f -exec file --mime-type -b {} + | sort | uniq -c | sort -rn

# Files not accessed in 30 days — candidates for cleanup
find ~/Downloads -maxdepth 1 -type f -atime +30 -printf '%A+ %s\t%p\n' | sort | numfmt --to=iec --field=2

# Which subdirectories consume the most space?
find . -maxdepth 1 -type d -exec du -sh {} + 2>/dev/null | sort -rh | head -20

# Dry run — show what would change (remove echo to execute)
find ~/Downloads -maxdepth 1 -type f -name '* *' -print0 | while IFS= read -r -d '' f; do
  dir=$(dirname "$f")
  base=$(basename "$f" | tr ' ' '-' | tr '[:upper:]' '[:lower:]')
  echo mv "$f" "$dir/$base"
done

# Sort Downloads chaos into folders by type
find ~/Downloads -maxdepth 1 -type f -print0 | while IFS= read -r -d '' f; do
  ext="${f##*.}"
  case "$ext" in
    pdf|epub)    dest="books" ;;
    jpg|png|svg) dest="images" ;;
    sh|py|rb)    dest="scripts" ;;
    *)           dest="other" ;;
  esac
  mkdir -p ~/Downloads/"$dest"
  echo mv "$f" ~/Downloads/"$dest"/
done

# Convert all epubs in a directory to asciidoc via pandoc
find . -name '*.epub' -type f -exec sh -c '
  for epub; do
    adoc="${epub%.epub}.adoc"
    pandoc -f epub -t asciidoc "$epub" -o "$adoc" \
      && printf "  → %s (%s lines)\n" "$adoc" "$(wc -l < "$adoc")" \
      || printf "  ✗ failed: %s\n" "$epub"
  done
' _ {} +

# Checksum all PDFs in parallel (4 processes)
find ~/Downloads -name '*.pdf' -print0 | xargs -0 -P4 md5sum

# Compare files pairwise with diff
find . -name '*.adoc' -print0 | xargs -0 -n2 diff --brief

# Backup every config file: cp <file> <file>.bak
find /etc -maxdepth 1 -name '*.conf' -print0 | xargs -0 -I{} cp {} {}.bak

# What files exist in study-A but not study-B?
diff <(find data/d000/education/ciceron-study -type f -name '*.adoc' | sort) \
     <(find data/d000/education/latin-study -type f -name '*.adoc' | sort)

# Side-by-side: file type census of two directories
paste <(find dir1 -type f -exec file --mime-type -b {} + | sort | uniq -c | sort -rn) \
      <(find dir2 -type f -exec file --mime-type -b {} + | sort | uniq -c | sort -rn)

awk '{print $2}' file.txt

awk -F: '{print $1, $3}' /etc/passwd

awk '/\[source,json\]/{getline; if ($0 ~ /^----/) {p=1; next}} p && /^----/{p=0; next} p' file.adoc

awk '{printf "%-30s %s\n", $1, $2}' file.txt

# Before
awk 'NR==73' /etc/ssh/sshd_config
# Change
sed -i '73s/#GSSAPIAuthentication no/GSSAPIAuthentication yes/' /etc/ssh/sshd_config
# After
awk 'NR==73' /etc/ssh/sshd_config

sed -n '10,20p' file.txt

# 1. LOCATE: find the line number
grep -n 'adoc-pdf' zsh/.zshrc

# 2. VALIDATE: read the exact line before changing
awk 'NR==1760' zsh/.zshrc

# 3. CHANGE: target by line number — only hits that line
sed -i '1760s/alias adoc-pdf=/alias build-adoc=/' zsh/.zshrc

# 4. VERIFY: confirm change AND check for collateral
grep -n 'build-adoc\|adoc-pdf' zsh/.zshrc

awk 'NR==1218 || NR==1760' zsh/.zshrc

# grep found the error at line 44164 — read 50 lines of context
awk 'NR>=44160 && NR<=44210' session-dump.adoc

# ISE syslog — extract failure reasons
grep -oP 'FailureReason=\K[^,;]+' /var/log/syslog | sort | uniq -c | sort -rn

# ISE — extract MAC addresses
grep -oP 'Calling-Station-ID=\K[0-9A-Fa-f:.-]+' /var/log/syslog | sort -u

# ISE — extract NAS IPs
grep -oP 'NAS-IP-Address=\K[0-9.]+' /var/log/syslog | sort -u

# ISE — extract device names
grep -oP 'NetworkDeviceName=\K[^,;]+' /var/log/syslog | sort -u

# Generic form — works for any key=value log format
grep -oP 'FIELD_NAME=\K[^,;]+' logfile | sort | uniq -c | sort -rn | head -20

curl -s localhost:8080/stats | jq '.stats.total_files'

jq '.results[] | select(.category == "standards")' response.json

jq -r '.[] | [.title, .path] | @tsv' response.json | column -t -s $'\t'

gh api "repos/EvanusModestus/domus-captures/commits?path=docs/&per_page=10" |
  jq -r '.[] | "\(.commit.author.date[:10]) \(.sha[:7]) \(.commit.message | split("\n")[0])"'

mkdir -p /tmp/adoc-backup-$(date +%F) && \
  find . -name "*.adoc" -type f -newermt "$(date +%F)" | \
  xargs -I{} cp {} /tmp/adoc-backup-$(date +%F)/

find .drafts -name "*.adoc" -type f | xargs -P4 -I{} asciidoctor -o /dev/null {}

find . -name "*.adoc" -type f -print0 | xargs -0 wc -l

diff <(grep '|' partials/trackers/work/adhoc/carryover.adoc | head -20) \
     <(git show HEAD~1:partials/trackers/work/adhoc/carryover.adoc | grep '|' | head -20)

diff <(find docs/modules/ROOT/pages/projects/chla/mschapv2-migration -name "*.adoc" -type f | sort) \
     <(grep -oP 'mschapv2-migration/[^[]+\.adoc' docs/modules/ROOT/nav.adoc | sort)

nvim "$(find data/ -name '*.adoc' -type f -printf '%T@ %p\n' | sort -rn | awk 'NR==1{print $2}')"

wc -l $(find docs/modules/ROOT -path '*mschapv2*' -name '*.adoc' -type f)

files=$(find .drafts -name 'in*' -type f) && [ -n "$files" ] && nvim $files

files=$(grep -rl '\[ \]' .drafts/*.adoc) && [ -n "$files" ] && nvim $files

grep -q 'TODO\|FIXME\|\[ \]' "$file" && nvim "$file"

files=$(find . -name "*tcp-clock*.age" -type f) && \
  [ -n "$files" ] && echo "$files" | xargs -I{} decrypt-file {} && \
  nvim $(echo "$files" | sed 's/\.age$//')

tee_clean() {
  tee >(sed 's/\x1b\[[0-9;]*m//g' > "$1")
}

# Color output on terminal, stripped in file
jq -C '.' data.json | tee_clean output.json
xq -C '.' data.xml | tee_clean output.json

# Wrap a whole block
{
  echo "=== Summary ==="
  jq -C '.[] | .name' data.json
} | tee_clean summary.txt

for cmd in asciidoctor asciidoctor-pdf pandoc rouge d2 mmdc age; do
  printf "%-20s %s\n" "$cmd" "$(command -v $cmd >/dev/null 2>&1 && echo 'OK' || echo 'MISSING')"
done

printf '---\n\n'

printf '%s\n\n' '---'

lsof -i TCP -n -P | awk '/ssh.*ESTABLISHED/ {print $2, $9}'

lsof -i TCP -n -P | awk '/ssh.*kvm-01.*ESTABLISHED/ {print $2}' | sort -u | xargs kill

lsof -i TCP -n -P | awk '/ssh.*ESTABLISHED/ {print $2}' | sort -u | xargs kill

find / -name "*.conf" 1>results.txt 2>errors.txt

find / -name "*.conf" 2>/dev/null

command 2>&1 | grep "pattern"

cat <<'EOF'
Line 1
Line 2
EOF

git commit -m "$(cat <<'EOF'
feat: add new feature

Multi-line description here.
EOF
)"

cd ~/atelier/_projects/personal/domus-api && uv run uvicorn domus_api.main:app --host 0.0.0.0 --port 8080

curl -s localhost:8080/ | jq

curl -s 'localhost:8080/search?q=mandiant' | jq

curl -s 'localhost:8080/search?q=mandiant' | jq '.results[] | {path, title, match_count}'

curl -s 'localhost:8080/pages?category=standards' | jq

curl -s localhost:8080/attributes | jq

gh search code "vault seal" --owner EvanusModestus --json repository,path,textMatches |
  jq '.[] | {repo: .repository.full_name, file: .path, match: .textMatches[].fragment}'

gh api 'repos/EvanusModestus/domus-captures/git/trees/main?recursive=1' |
  jq '[.tree[] | select(.path | endswith(".adoc"))] | length'

bat docs/modules/ROOT/pages/2026/04/WRKLOG-$(date +%Y-%m-%d).adoc

bat docs/modules/ROOT/partials/trackers/work/priorities/current.adoc

bat docs/modules/ROOT/partials/trackers/work/adhoc/carryover.adoc

bat docs/modules/ROOT/partials/projects/mandiant-remediation/summary.adoc

grep -rl "MSCHAPv2" docs/modules/ROOT/ --include="*.adoc" | sort

grep -rn "pattern" docs/modules/ROOT/partials/codex/ --include="*.adoc" -B1 -A3

ls -1 docs/modules/ROOT/pages/2026/04/WRKLOG-*.adoc

echo $(( ($(date +%s) - $(date -d "2026-03-09" +%s)) / 86400 ))

age --decrypt -i ~/.secrets/.metadata/keys/master.age.key \
  data/d001/projects/mandiant-remediation/findings-status-2026-04-16.adoc.age \
  | bat --language asciidoc

for d in data/d001/projects/*/; do
  total=$(find "$d" -type f | wc -l)
  plain=$(find "$d" -type f ! -name '*.age' ! -name 'README.adoc' ! -name '.gitkeep' ! -name '*.py' | wc -l)
  printf "%-25s %s files  %s plaintext\n" "$(basename "$d")" "$total" "$plain"
done

for d in p1-cap-03{7,8,9}; do
  for f in data/d000/education/quijote-study/notas/$d/*.adoc; do
    d000 build "$d/$(basename "$f" .adoc)" html --variant light-cyan
  done
done

d000 build p1-cap-038/texto-anotado html --variant light-cyan
d000 build p1-cap-038/texto-anotado pdf --theme light-cyan

for d in p1-cap-03{7,8,9}; do
  for f in data/d000/education/quijote-study/notas/$d/*.adoc; do
    d000 build "$d/$(basename "$f" .adoc)" pdf --theme light-cyan
  done
done

firefox data/d000/education/quijote-study/notas/p1-cap-03{7,8,9}/output/*.html &
firefox data/d000/education/quijote-study/notas/p1-cap-03{7,8,9}/output/*.pdf &

lp data/d000/education/quijote-study/notas/p1-cap-03{7,8,9}/output/*.pdf

d000 build annotated-text pdf --theme light-cyan
d000 build lpl-study/notas/texto-anotado pdf --theme light-cyan

d000 build de-oratore/libro-i/texto-anotado html --variant light-cyan

ls ~/atelier/_bibliotheca/domus-asciidoc-build/themes/pdf/ | sed 's/-theme\.yml//'
# base blue burgundy catppuccin creative dark don-quijote green
# learning light-cyan navy operations orange purple reference royal

~/atelier/_bibliotheca/domus-asciidoc-build/docinfo/compose.sh --list
# light dark catppuccin royal light-cyan

export ISE_HOST="{ise-ip}" ISE_USER="admin" ISE_PASS="$(gopass show -o ise/admin)"

curl -sk "https://$ISE_HOST:{ise-ers-port}/ers/config/identitygroup" \
  -H "Accept: application/json" -u "$ISE_USER:$ISE_PASS" | jq '.SearchResult.resources[].name'

curl -sk "https://$ISE_HOST:{ise-ers-port}/ers/config/endpoint?filter=mac.EQ.AA:BB:CC:DD:EE:FF" \
  -H "Accept: application/json" -u "$ISE_USER:$ISE_PASS" | jq '.SearchResult.total'

openssl x509 -in {cert-dir}/client.pem -text -noout | head -30

openssl x509 -in {cert-dir}/client.pem -enddate -noout

ss -tlnp | grep -E ':{port-https}|:{port-ssh}|:{port-ldaps}'

nc -zv {ise-ip} {ise-ers-port}

dig {ise-hostname} +short

# SSH to ISE
ssh admin@ise-02.inside.domusdigitalis.dev

# Verify NAS repo
show repository nas-01

# Get encryption key (on workstation)
dsource d000 dev/storage
echo $ISE_BACKUP_KEY

# Run backup
backup pre-rotation-2026-06 repository nas-01 ise-config encryption-key plain <KEY>

ssh admin@ise-02.inside.domusdigitalis.dev
show repository nas-01

configure terminal
repository nas-01
  url nfs://10.50.1.70:/volume1/ise_backups
exit

restore <backup-filename> repository nas-01 encryption-key plain <KEY>

show vrrp
show configuration commands | grep vrrp | grep 'address'

show configuration commands | grep 'firewall zone' | grep 'member'

show dhcp server leases
show arp

show interfaces

command -v lpstat && echo "CUPS present" || echo "CUPS not installed"
lpstat -r                                # scheduler running?
lpstat -p -d                             # printers + default

sudo systemctl enable --now cups         # start + persist

lpinfo -v                                # available backends/URIs
lpinfo -m | grep -i <brand>             # available drivers

sudo lpadmin -p <name> -v <uri> -m everywhere -E
lpoptions -d <name>

lp file.pdf                              # default printer
lp -d <name> -o sides=two-sided-long-edge file.pdf

pwsh -NoLogo -Command 'Get-Process | Sort-Object WorkingSet64 -Descending |
  Select-Object -First 5 ProcessName, Id,
    @{N="MB";E={[math]::Round($_.WorkingSet64/1MB)}} | Format-Table'

pwsh -NoLogo -Command 'Get-Process | Where-Object {$_.ProcessName -like "*teams*"} | Stop-Process'
pwsh -NoLogo -Command 'Start-Process "ms-teams"'

pwsh -NoLogo -Command 'Get-Process | Sort-Object WorkingSet64 -Descending |
  Select-Object -First 5 ProcessName, Id,
    @{N="MB";E={[math]::Round($_.WorkingSet64/1MB)}} | ConvertTo-Json' | jq '.'

netsh wlan disconnect interface="Wi-Fi"
netsh wlan show networks mode=bssid
netsh wlan connect name="CHLA-Remote" interface="Wi-Fi"

ssh evan@modestus-razer.inside.domusdigitalis.dev

age --decrypt -i ~/.secrets/.metadata/keys/master.age.key \
  data/d001/projects/mandiant-remediation/findings-status-2026-04-16.adoc.age \
  | bat --language asciidoc --file-name "findings-status-2026-04-16.adoc"

for f in data/d001/projects/mandiant-remediation/{findings-status,guest-acl-update,siem-report}-2026-04-16.adoc; do
  rm -f "${f}.age" && echo y | encrypt-file "$f"
done

for f in data/d001/projects/*/*.adoc; do
  age="${f}.age"
  if [ -f "$f" ] && [ -f "$age" ]; then
    pt_mod=$(/usr/bin/stat -c'%Y' "$f")
    age_mod=$(/usr/bin/stat -c'%Y' "$age")
    [ "$pt_mod" -gt "$age_mod" ] && echo "STALE: $f"
  fi
done

shred -u data/d001/projects/mandiant-remediation/man-report.txt

find data/d001/projects -type f ! -name '*.age' ! -name 'README.adoc' ! -name '.gitkeep' ! -name '*.py' | sort

wpctl status                                    # PipeWire status
pactl list sinks short                          # list audio sinks
pw-play /usr/share/sounds/freedesktop/stereo/bell.oga  # test default sink
journalctl -b --grep='sof|cs35l56' --no-pager | tail -20  # kernel audio firmware
cat /proc/asound/cards                          # ALSA sound cards

gopass-personal-docs    # interactive entry creation
gopass-query bills      # list recurring bills with totals
gopass-query storage    # list storage units with gate codes
gopass-query export bills  # export category to JSON

make new-day      # create today's worklog + update attributes
make serve        # build + local server (port 8000)
make              # build only
make sync-nav     # sync worklog nav entries
make update-index # rebuild monthly index

ssh kvm-01 "sudo virsh list --all"
ssh kvm-02 "sudo virsh list --all"

ssh kvm-01 "ls -lh /mnt/nas/isos/*[Ii][Ss][Ee]* /var/lib/libvirt/images/*[Ii][Ss][Ee]* /mnt/onboard-ssd/isos/*[Ii][Ss][Ee]* 2>/dev/null"
ssh kvm-02 "ls -lh /mnt/nas/isos/*[Ii][Ss][Ee]* /mnt/ssd/libvirt/images/*[Ii][Ss][Ee]* 2>/dev/null"

sudo virsh console <vm-name>             # Escape: Ctrl+]

ssh kvm-01 "mount | grep nas; ls /mnt/"

for d in data/d001/projects/*/; do
  total=$(find "$d" -type f | wc -l)
  plain=$(find "$d" -type f ! -name '*.age' ! -name 'README.adoc' ! -name '.gitkeep' ! -name '*.py' | wc -l)
  echo "$(basename "$d") | ${total} files | ${plain} plaintext"
done

{
  echo "=== Power Supply ==="
  cat /sys/class/power_supply/*/status
  echo ""
  cat /sys/class/power_supply/*/type
  echo ""
  echo "=== UPower ==="
  upower -d | grep -E 'state|percentage|energy-rate|voltage'
  echo ""
  echo "=== dmesg (typec/thunderbolt/PD) ==="
  sudo dmesg | grep -iE 'typec|thunderbolt|ucsi|PD|power.delivery|charging' | tail -20
  echo ""
  echo "=== Pacman log (kernel/typec) ==="
  grep -iE 'thunderbolt|typec|ucsi|^.*upgraded linux ' /var/log/pacman.log | tail -20
} | tee /tmp/INC-$(date +%F)-usbc-charging.txt