PeopleSoft Time Entry

Tube System Upgrade

_

3.0

ISE batch onboard script debugging — fixed 7 var++ bugs + local scope. 15 MACs staged for re-run. iTrack 3528165

Abnormal Security (ESA→EOP)

_

2.0

Policy review prep — EOP cmdlet mapping (5 cmdlets), Jihad spreadsheet review, Tyler migration doc review

ISE Policy / Change Management

_

2.5

CR board prep — Guest ACL Hardening + Anonymous Identity Test. CR document review, lab validation planning

CISSP Study / Admin

_

0.5

Exam scheduling coordination

Total

8.0

Change Management

_

2.0

CR Board attendance — Guest ACL Hardening (APPROVED), Anonymous Identity Test (APPROVED). Post-approval coordination

Linux Research / Server Deployment

_

2.0

Linux Remediation kickoff meeting + inventory SQL query development (dc-run-sql)

Abnormal Security (ESA→EOP)

_

2.5

DKIM investigation (PowerShell shows disabled), ESA→EOP policy divergence analysis, d001 deliverable

ISE Annual Cert Renewal

_

1.0

Cert renewal meeting — 52 days to expiry, DigiCert CA, CSR generation prep

Spectrum TV/GetWell iPad Refresh

_

0.5

Android handheld scanners — ISE policy scoping for shared device auth (Argam escalation)

Total

8.0

Abnormal Security (ESA→EOP)

_

3.0

ESA mail flow policy divergence — full Five Canons analysis. ESA-Bypass skipping blacklist enforcement. EOP anti-spam BCL/SCL policy review

ISE Annual Cert Renewal

_

1.0

CSR generation commands prepared, d001 config staged

QRadar → Sentinel / Monad

_

1.5

Monad pipeline weekly sync with William Cox — FMC/ISE sources, transform design, jq↔GJSON translation reference

Spectrum TV/GetWell iPad Refresh

_

1.0

Getwell iPads — iPSK onboard 2 devices (4C:B9:10:9F:05:9F, C4:12:34:2D:F3:14)

ISE Policy / General Support

_

1.5

Carry-forward task management, CR implementation scheduling coordination (Guest ACL + Anonymous Identity)

Total

8.0

QRadar → Sentinel / Monad

_

4.0

Monad API discovery — JWT decode, OpenAPI spec, pipeline CRUD operations, edge constraints. Created ise-lab-v2 filtered pipeline via API

ISE Annual Cert Renewal

_

1.0

TLS cert fingerprint script + runbook created (d001 encrypted)

Centralized rsyslog Server

_

1.0

rsyslog central collector partial created (d001 encrypted)

Abnormal Security (ESA→EOP)

_

1.0

ESA-Bypass investigation continued — policy divergence follow-ups

Admin / PeopleSoft

_

1.0

PeopleSoft codes tracker updated — all 28 active projects audited and mapped

Total

8.0

Abnormal Security (ESA→EOP)

_

2.0

ESA-Bypass policy divergence follow-ups, DKIM investigation continued, AutoForwarding remediation

ISE Policy / General Support

_

2.0

Carry-forward items: Tube System re-run coordination, Alex Pena device verification, Android scanners policy (June 8 deadline)

Change Management

_

1.5

Guest ACL + Anonymous Identity implementation scheduling with Tony Sun, David Rukiza, Argam

Linux Research / Server Deployment

_

1.5

Linux inventory discovery — query refinement, dc-run-sql validation

Documentation / Admin

_

1.0

Worklog triage, task prioritization, PeopleSoft code assignment

Total

8.0

Abnormal Security (ESA→EOP)

2.0

2.5

3.0

1.0

2.0

10.5

QRadar → Sentinel / Monad

—

—

1.5

4.0

—

5.5

Change Management / CRs

2.5

2.0

—

—

1.5

6.0

ISE Annual Cert Renewal

—

1.0

1.0

1.0

—

3.0

Tube System Upgrade

3.0

—

—

—

—

3.0

Linux Research / Remediation

—

2.0

—

—

1.5

3.5

Spectrum/GetWell/Scanners

—

0.5

1.0

—

—

1.5

Centralized rsyslog

—

—

—

1.0

—

1.0

ISE Policy / General Support

—

—

1.5

—

2.0

3.5

Admin / Documentation

0.5

—

—

1.0

1.0

2.5

Daily Total

8.0

8.0

8.0

8.0

8.0

40.0

Holiday

8.0

Memorial Day

Total

8.0

ISE Policy / General Support

_

4.0

Zebra printer network issue — validated 217 Zebra devices via ISE DataConnect, 14,300 auths with 0 failures. Confirmed ISE auth is not root cause

Abnormal Security (ESA→EOP)

_

4.0

SEG-to-Defender migration — deployed all 5 MDO policy layers (Anti-Spam, Anti-Phish, Anti-Malware, Safe Attachments, Safe Links) via Exchange Online PowerShell. Validated with time-sliced message trace (37k delivered, 146 spam filtered)

Total

8.0

Change Management

_

3.0

Two iTrack changes prepared: WIR-M-01 guest ACL hardening (Page Ground switch, Tony Sun + Andrian Ledezma) and WIR-L-01 EAP anonymous identity MDM profiles (Argam Darbindian + Andrian Ledezma). Full rollback commands included

MSCHAPv2 to EAP-TLS Migration

_

3.0

GPO reports v2 — 8-report PowerShell suite: GPO→OU mapping, OU device census, security filtering, stale accounts, link conflicts, inheritance, GPO vs ISE reconciliation, migration readiness matrix

ISE Policy / General Support

_

2.0

chlxisecsftp investigation — 6-phase forensic ownership determination for mystery server 10.101.27.175 (Ben Castillo, 2019 build). SSH forensics, ISE cross-reference, AD/vCenter/CMDB evidence matrix

Total

8.0

ISE Policy / General Support

_

8.0

General support / admin (no worklog captured)

Total

8.0

ISE Policy / General Support

_

8.0

General support / admin (no worklog captured)

Total

8.0

Holiday (Memorial Day)

8.0

—

—

—

—

8.0

ISE Policy / General Support

—

4.0

2.0

8.0

8.0

22.0

Abnormal Security (ESA→EOP)

—

4.0

—

—

—

4.0

Change Management

—

—

3.0

—

—

3.0

MSCHAPv2 to EAP-TLS Migration

—

—

3.0

—

—

3.0

Daily Total

8.0

8.0

8.0

8.0

8.0

40.0

QRadar → Sentinel / Monad

_

5.0

ISE→Monad secure syslog integration — extracted Monad TLS cert chain, uploaded CA to ISE Trusted Certificates, configured Remote Logging Target (TCP 6514). Troubleshooting streaming errors in Monad console

QRadar → Sentinel / Monad

_

3.0

Created step-by-step runbook for ISE Remote Logging Target→Monad (cert extraction, ISE import, RLT config, logging categories, validation, troubleshooting). Encrypted as d001 partial

Total

8.0

QRadar → Sentinel / Monad

_

4.0

Finalized ISE-to-Monad secure syslog runbook. Restructured as d001 partial for encrypt/decrypt lifecycle. Updated README with ISE→Monad section

Documentation / Admin

_

2.0

Carryover backlog updates — Monad/SIEM entries reflect ISE integration progress. Worklog maintenance

ISE Policy / General Support

_

2.0

General support — task triage, priority alignment

Total

8.0

Documentation / Admin

_

4.0

Security audit — encrypted all 231 plaintext .adoc files in d001. Removed gitignore whitelist exceptions. Token rotation identified as TODO

ISE Policy / General Support

_

4.0

General support / admin — PeopleSoft charge code verification, task management

Total

8.0

Documentation / Admin

_

4.0

Completed d001 encryption — remaining 52 whitelisted plaintext files encrypted. Removed local gitignore overrides. Token rotation TODO carried forward

ISE Policy / General Support

_

4.0

General support / admin

Total

8.0

ISE Policy / General Support

_

8.0

General support / admin (no CHLA-specific worklog detail captured)

Total

8.0

QRadar → Sentinel / Monad

8.0

4.0

—

—

—

12.0

ISE Policy / General Support

—

2.0

4.0

4.0

8.0

18.0

Documentation / Admin

—

2.0

4.0

4.0

—

10.0

Daily Total

8.0

8.0

8.0

8.0

8.0

40.0

ISE Policy / General Support

_

8.0

General support / admin (no worklog detail captured)

Total

8.0

ISE Policy / General Support

_

8.0

General support / admin (no worklog detail captured)

Total

8.0

MSCHAPv2 to EAP-TLS Migration

_

4.0

Standard migration report — 5-sheet DataConnect SQL (exec summary, weekly trend, wave breakdown, device detail, stale devices). 6,230 MSCHAPv2 devices, 69.2% progress. VPN/OEAP exclusions applied

Abnormal Security (ESA→EOP)

_

2.0

CAB approval follow-up — implementation scheduled 2026-05-14. Created cab-talking-points partial (elevator pitch, key points, anticipated Q&A)

QRadar → Sentinel / Monad

_

2.0

Overview updated — 3 secrets configured in CHLA tenant. 404 on DCE endpoint confirms path works, DCR not yet created. Blockers: Rule ID + Stream Name pending Victor/Mauricio

Total

8.0

MSCHAPv2 to EAP-TLS Migration

_

8.0

Sheet 6 (Policy Match by Protocol) — new SQL query: policy set x auth rule x auth profile x protocol with device counts. Added to standard report with Excel integration. Cert-based anonymous outer identity validation requirement identified

Total

8.0

MSCHAPv2 to EAP-TLS Migration

_

5.0

Report automation — dc-run-sql.sh, build-enhanced-report.py (Catppuccin dashboard), build-full-report.py, device-detail-to-xlsx.py. Runbook created. SQL optimization: 90d→30d window, removed correlated subquery, fixed migration_wave bucketing

MSCHAPv2 to EAP-TLS Migration

_

2.0

d000 validation — all 6 SQL queries tested against home lab ISE 3.2. 5-table JOIN validated (48 cols). Full 6-sheet Excel pipeline end-to-end

Documentation / Admin

_

1.0

Separated concerns: project README (status/ownership), scripts README (tool reference), runbook (procedure)

Total

8.0

MSCHAPv2 to EAP-TLS Migration

—

—

4.0

8.0

7.0

19.0

ISE Policy / General Support

8.0

8.0

—

—

—

16.0

Abnormal Security (ESA→EOP)

—

—

2.0

—

—

2.0

QRadar → Sentinel / Monad

—

—

2.0

—

—

2.0

Documentation / Admin

—

—

—

—

1.0

1.0

Daily Total

8.0

8.0

8.0

8.0

8.0

40.0

ISE Policy / General Support

_

3.0

iTrack #1929634 — CCE Dialysis connectivity (Jeff Begonia, MAC 00:18:7D:D6:69:38). iTrack #3129942 — Arcadia Echo machine (Mark James, wired 00:04:5F:7F:2A:56 + wireless A4:FC:77:4F:0D:73). Investigation prep and ERS/MnT query staging

Firewall Audit

_

2.0

Firewall audit project enhanced — 5 query templates added to fmc-discovery.adoc (prefilter, policy assignments, NAT, EtherChannel, access rules, deployment status). Quick Start runbook created

CISSP Study / Admin

_

1.0

CISSP timeline reset — June 1 → July 12 across 14 files (trackers, portfolio, nav, metadata, education). RHCSA deadline updated June 1 → Q3 2026

ISE Policy / Change Management

_

1.0

Mandiant remediation follow-up. Guest ACL continued validation

Documentation / Admin

_

1.0

Stale adoc audit (14 files updated). pfSense → VyOS corrections in dossier

Total

8.0

ISE Policy / General Support

_

4.0

INC-2026-05-05-isensix-down — VLAN mismatch root cause. Reassigned via ERS PUT. Fleet audit: 59+ iSensix devices, 14 stragglers identified. Arcadia Echo follow-up — device hitting correct Medical onboard rule

MSCHAPv2 to EAP-TLS Migration

_

2.0

MSCHAPv2 maintenance window active (Will). Coordination and monitoring

Abnormal Security (ESA→EOP)

_

1.0

Abnormal platform continued research. Meeting prep

Documentation / Admin

_

1.0

iTrack ticket updates, general admin

Total

8.0

ISE Policy / General Support

_

2.0

INC-2026-05-06-wireless-multi-device — Vocera/WYSE/neuro physicians (Duque Ground) emergency. ISE ruled out (zero RADIUS failures). Root cause: AP roaming/flapping. VP briefed with Grafana dashboard

MSCHAPv2 to EAP-TLS Migration

_

2.0

Protocol distribution report: 6,227 MSCHAPv2 devices, 14,249 EAP-TLS/TEAP (70% migrated). Per-wave platform guides built (Chromebooks, WYSE, Windows, macOS, iOS)

Abnormal Security (ESA→EOP)

_

1.5

Working session with Will Cox, Vanessa Ahn, Alex Mejia, vendor team. Architecture documented: MDO primary, Abnormal secondary. CR assigned for read/write permissions (CAB May 13)

QRadar → Sentinel / Monad

_

1.0

Monad vendor working session. siem-migration-playbook.adoc with D2 diagrams and meeting notes

ISE Policy / Change Management

_

1.0

Mandiant ACL remediation team doc — guest ACL lockdown. Renamed Guest-CWA-Redirect-v2. SMB 445 host validation queries

Linux Research / Server Deployment

_

0.5

Linux EAP-TLS deployment guide renamed. Team partials reorganized. CVE inventory moved to investigations

Total

8.0

BMS Device Inventory

_

2.0

7 VFD devices reassigned to IoT_Onboard. Built ise-batch-onboard.sh — reusable batch endpoint group assignment (mac-file, group-name, description). Lab tested on d000

ISE Policy / General Support

_

2.5

INC-2026-05-07 Duque Ground physician connectivity (C-level escalation) — Dr Agers + Dr Joshi, 4 devices. Zero RADIUS failures. KDC cert EKU issue identified. Netlogon 5719 errors (hospital-wide DC reachability). C-level evidence response drafted

QRadar → Sentinel / Monad

_

1.5

Monad pipeline Sentinel output deployment — 4 technical partials (overview, Azure prereqs, config, validation). 3 blockers documented: Azure private network, tenant console error, DCR not created. Email draft to Monad vendor

Abnormal Security (ESA→EOP)

_

1.5

CR-2026-05-07-abnormal-read-write drafted — iTrack fields, 4 implementation phases, backout options, 5 testing sections. CAB May 13, implementation May 14. Jason Landeros implementer

Documentation / Admin

_

0.5

Tracker updates (9 files), investigation naming convention standardized

Total

8.0

ISE Policy / General Support

_

4.0

CVE-2026-43284/CVE-2026-43500 (Dirty Frag) — kernel LPE investigation. Proved module autoload without privileges. Antora incident (4 partials). d001 enterprise assessment, CHLA mitigation plan, advisory, tracking matrix. WSL2 unpatched (6.18.26 vs required 6.18.28)

ISE Policy / General Support

_

1.5

Dirty Frag continued — applied blocklist mitigation, fixed false-sense-of-security in status check (4-state verdict). Enterprise advisory distributed

MSCHAPv2 to EAP-TLS Migration

_

1.0

MSCHAPv2 maintenance window monitoring. Will coordination

Abnormal Security (ESA→EOP)

_

1.0

Abnormal CR follow-up — CAB preparation for May 13

Documentation / Admin

_

0.5

Worklog updates, codex entries (lsof SSH session management, xargs/kill patterns)

Total

8.0

ISE Policy / General Support

3.0

4.0

2.0

2.5

5.5

17.0

MSCHAPv2 to EAP-TLS Migration

—

2.0

2.0

—

1.0

5.0

Abnormal Security (ESA→EOP)

—

1.0

1.5

1.5

1.0

5.0

QRadar → Sentinel / Monad

—

—

1.0

1.5

—

2.5

BMS Device Inventory

—

—

—

2.0

—

2.0

Firewall Audit

2.0

—

—

—

—

2.0

ISE Policy / Change Management

1.0

—

1.0

—

—

2.0

CISSP Study / Admin

1.0

—

—

—

—

1.0

Linux Research / Server Deployment

—

—

0.5

—

—

0.5

Documentation / Admin

1.0

1.0

—

0.5

0.5

3.0

Daily Total

8.0

8.0

8.0

8.0

8.0

40.0

ISE Policy / General Support

_

4.0

Endpoint disconnect investigation scaffold for Rhey Aquino — F8:75:A4:F3:61:25 (d-mj0dntn2). Built full investigation structure: ERS lookup, MnT session, MnT auth history, DataConnect flapping query partials

MSCHAPv2 to EAP-TLS Migration

_

1.5

MSCHAPv2 migration prep — Will’s maintenance window opens 5/4. Pre-work planning and coordination

Abnormal Security (ESA→EOP)

_

1.0

Abnormal Security platform research continued

Documentation / Admin

_

1.5

Build toolchain portability verification (domus-asciidoc-build for work WSL). Commit prep and staging for encrypted investigation files

Total

8.0

ISE Policy / General Support

_

3.0

Rhey Aquino endpoint disconnect — pulled, decrypted, ran ERS/MnT/DataConnect queries against F8:75:A4:F3:61:25. Findings partial updated. Teams response

ISE Policy / General Support

_

1.5

Philips device onboard verification — D4:A2:CD:9D:13:3A confirmed authenticated to Medical_Onboard

Abnormal Security (ESA→EOP)

_

1.0

Dashboard review, meeting notes follow-up

ASA VPN Okta to Entra

_

1.0

VPN split tunnel — Jenny’s response drafted, follow-up questions addressed

MSCHAPv2 to EAP-TLS Migration

_

1.0

Maintenance window prep — Will’s window 5/4. Pre-staging and coordination

Documentation / Admin

_

0.5

PeopleSoft time tracking

Total

8.0

ISE Policy / General Support

_

3.0

ISE advisory CVSS 9.9 follow-up. Strongline Gateway VLAN coordination (38 days). k3s NAT verification (46 days)

MSCHAPv2 to EAP-TLS Migration

_

2.0

Wednesday cadence call. Action-item tracker updates per workstream

QRadar → Sentinel / Monad

_

1.5

Monad pipeline evaluation continued. Sentinel connector mapping follow-up

Linux Research / Server Deployment

_

1.0

Linux research continued (CISO priority). Enterprise Linux 802.1X follow-up

Documentation / Admin

_

0.5

iTrack ticket triage

Total

8.0

ISE Policy / General Support

_

2.5

JAMF cert subject change investigation (Drew Kaurloto) — validated EMAIL→emailAddress change has zero ISE impact. All cert auth profiles use SUBJECT_COMMON_NAME via ERS API

QRadar → Sentinel / Monad

_

2.0

Monad pipeline evaluation continued. SIEM migration workstream coordination

ISE Policy / Change Management

_

1.5

Mandiant remediation — Guest ACL lab validation. Q2 2026 assessment prep

Abnormal Security (ESA→EOP)

_

1.0

Abnormal Security project scaffolded. Session notes structure established

Documentation / Admin

_

1.0

Worklog system improvements — make new-month (May scaffolded), month rollover automation. Stub detection in audit

Total

8.0

ISE Policy / General Support

_

2.5

CVE-2026-31431 (Copy Fail) organizational response — detection script, mitigation proof document, testing across WSL2 (Arch/Fedora/Oracle Linux), RHEL built-in kernel discovery. David Ntashamaje MDE KQL identified 29 WSL devices

ISE Policy / General Support

_

2.0

Endpoint D-N45577 GPO resolution — root cause: device in wrong OU pushing PEAP instead of TEAP. Moved to Win11 OU, TEAP EAP-TLS working with user+machine chaining

ISE Policy / General Support

_

1.0

JAMF cert subject change (Drew Kaurloto) — ISE cert auth profiles validated, zero impact confirmed via ERS API

Abnormal Security (ESA→EOP)

_

1.0

First Abnormal Security working session. Investigation scaffolded, README updated

MSCHAPv2 to EAP-TLS Migration

_

1.0

MSCHAPv2 migration prep — 3 days to maintenance window. Coordination with Will

Documentation / Admin

_

0.5

Build error fixes (28 xref errors), stale tracker refresh

Total

8.0

ISE Policy / General Support

4.0

4.5

3.0

2.5

5.5

19.5

MSCHAPv2 to EAP-TLS Migration

1.5

1.0

2.0

—

1.0

5.5

Abnormal Security (ESA→EOP)

1.0

1.0

—

1.0

1.0

4.0

QRadar → Sentinel / Monad

—

—

1.5

2.0

—

3.5

ASA VPN Okta to Entra

—

1.0

—

—

—

1.0

ISE Policy / Change Management

—

—

—

1.5

—

1.5

Linux Research / Server Deployment

—

—

1.0

—

—

1.0

Documentation / Admin

1.5

0.5

0.5

1.0

0.5

4.0

Daily Total

8.0

8.0

8.0

8.0

8.0

40.0

QRadar → Sentinel / Monad

_

4.0

Streamlined QRadar guide finalized (2 commits). SIEM migration report generated — xlsx, csv, json deliverables under d001. LogSource/offense/volume/window data collected

ISE Policy / General Support

_

1.5

CAB prep for SRT Research VLAN 233 (CHLA-Research) — talking points, scope, risk, rollback, test plan

Linux Research / Server Deployment

_

1.0

Data forensics toolchain installed (poppler, tesseract, imagemagick, exiftool, binwalk, testdisk, hashdeep). Local AI image analysis tested (minicpm-v via Ollama)

MSCHAPv2 to EAP-TLS Migration

_

1.0

Scheduled recurring Wednesday cadence call. Drafted invite list (8 stakeholders). Netapi endpoint report planning

Documentation / Admin

_

0.5

Mandiant remediation prep — Excel findings from 4/16, Guest ACL lab validation planning

Total

8.0

Change Management

_

2.0

CAB presentation at 15:00 — SRT Research VLAN 233 extension to 9 SRT access floors + distribution rename. APPROVED. Tony Sun implementor, Evan presenter/tester

ISE Policy / General Support

_

3.0

PRJ-downtime-computers ISE DataConnect wireless audit — built dc_query helper (Python + oracledb), v2 query (identity_group/endpoint_profile/authorization_rule). Results: 45 computers, 16 violating wireless, 29 compliant wired-only. Report v3 delivered to management

QRadar → Sentinel / Monad

_

1.0

SIEM migration report ready for stakeholder presentation. Connector mapping next step. Monad evaluation continued (43 days lead role)

MSCHAPv2 to EAP-TLS Migration

_

1.0

Scheduled recurring Wednesday cadence — invite list finalized (Tony Martinez, Mark Silva, Argam, Drew, Andrew, Jason, Victor, Justin). Action-item tracker build started

Documentation / Admin

_

1.0

GitHub API cross-repo activity audit (12 repos, 181 commits). Fixed git identity split in dots-quantum. ISE advisory CVSS 9.9 Patch 10 status check

Total

8.0

MSCHAPv2 to EAP-TLS Migration

_

3.0

First recurring Wednesday cadence call. Presented netapi endpoint report (6,084 devices, 29 device types). Built action-item tracker per workstream (8 platforms)

QRadar → Sentinel / Monad

_

2.0

LogSourceType-to-Sentinel connector mapping. Monad pipeline evaluation continued (44 days)

ISE Policy / General Support

_

1.5

ISE advisory CVSS 9.9 Patch 10 check. ISE admin MFA enforcement recommendation. Dr. Kim iPSK device follow-up

ISE Policy / Change Management

_

1.0

Mandiant remediation — 4/16 findings Excel update. Guest ACL lab validation (GUEST_CWA_REDIRECT_MAX_SECURITY)

Documentation / Admin

_

0.5

PeopleSoft time tracking, iTrack ticket triage

Total

8.0

ISE Policy / General Support

_

3.0

P0 task backlog audit — identified 45-day-old blockers (k3s NAT, Wazuh indexer). Disaster Recovery scoping. Linux Research follow-up (CISO priority)

QRadar → Sentinel / Monad

_

2.0

Monad evaluation continued. Sentinel KQL proficiency development

Documentation / Admin

_

2.0

Landing page automation — added current-day/current-date/current-worklog attributes to antora.yml. Created make update-today-attrs target

ISE Policy / Change Management

_

1.0

Mandiant Q2 2026 assessment prep. Guest ACL lab follow-up

Total

8.0

ISE Policy / General Support

_

3.0

ISE advisory tracking (CVSS 9.9). k3s NAT verification follow-up (44 days). Strongline Gateway VLAN follow-up (37 days). Enterprise Linux 802.1X standardization

Linux Research / Server Deployment

_

2.0

Linux research continued (CISO priority, behind schedule). Shahab/Ding deployment standardization

Abnormal Security (ESA→EOP)

_

1.5

Initial research on AI platform. ESA cutover timeline review

DMZ Migration

_

1.0

External services audit behind NetScaler — initial scoping

Documentation / Admin

_

0.5

iTrack ticket closure, PeopleSoft admin

Total

8.0

QRadar → Sentinel / Monad

4.0

1.0

2.0

2.0

—

9.0

ISE Policy / General Support

1.5

3.0

1.5

3.0

3.0

12.0

MSCHAPv2 to EAP-TLS Migration

1.0

1.0

3.0

—

—

5.0

Change Management

—

2.0

—

—

—

2.0

ISE Policy / Change Management

—

—

1.0

1.0

—

2.0

Linux Research / Server Deployment

1.0

—

—

—

2.0

3.0

Abnormal Security (ESA→EOP)

—

—

—

—

1.5

1.5

DMZ Migration

—

—

—

—

1.0

1.0

Documentation / Admin

0.5

1.0

0.5

2.0

0.5

4.5

Daily Total

8.0

8.0

8.0

8.0

8.0

40.0

ISE Policy / General Support

_

3.0

P1 infrastructure incident — dual KVM hypervisor outage recovery. kvm-02 restored (6 VMs), bridge VLAN PVID mismatch corrected, NAS fstab hardened. kvm-01 fiber CRC errors on Te1/0/2, moved to Te1/0/8, 8 VMs started

Meetings

_

3.0

Onsite security team meeting — 5 workstreams: Abnormal Security ESA migration, Microsoft Defender MDE onboarding, Sentinel KQL library, Monad syslog level strategy (RFC 5424), Firewall/DMZ inventory. 12 action items assigned

Abnormal Security (ESA→EOP)

_

1.0

ESA migration timeline discussion, quarantine alignment, rollback plan review (from meeting)

QRadar → Sentinel / Monad

_

1.0

Monad pipeline — approved syslog level 6 source list defined, detection gap analysis discussed (from meeting)

Total

8.0

Abnormal Security (ESA→EOP)

_

2.5

Meeting notes consolidation — Defender docs Linux toolchain organized, email policy search patterns, KQL query extraction patterns across security domains

ISE Policy / General Support

_

2.0

Morning WiFi diagnostics (CHLA-Remote profile verification, adapter enumeration, BSSID scanning). Infrastructure carryover from KVM incident

Change Management

_

1.5

CR-2026-04-15 SRT VLAN — iTrack submission preparation (due tomorrow)

Documentation / Admin

_

2.0

PowerShell codex — network diagnostics (WiFi profiles, adapter enumeration, WLAN discovery, service enumeration). PowerShell→JSON→jq bridge patterns

Total

8.0

Change Management

_

2.5

CR-2026-04-15 SRT Research VLAN — pre-change baseline captured and age-encrypted (access switch, Nexus distribution, ISE config). Change window execution

Abnormal Security (ESA→EOP)

_

2.0

Abnormal Security read-only O365/email integration completed during morning meeting. ESA migration upgraded to active evaluation phase

ISE Policy / General Support

_

2.0

ISE ERS/MnT/DataConnect API lab testing — endpoint CRUD, session queries, SQL queries via oracledb. Key discoveries: MnT XML responses, MAC-only reliable key, CoA target is NAS IP

ISE Policy / General Support

_

1.5

ISE endpoint group flapping incident (INC-2026-04-15) — IoT devices reverting from iPSK to GuestEndpoints. Root cause: MAB fallback overrides staticGroupAssignment. ERS API remediation

Total

8.0

ISE Policy / General Support

_

3.0

FMC REST API deep dive — live API calls against FMC, 8 FTDs enumerated across 3 datacenters, NetScaler DMZ zones discovered, Perimeter ACP confirmed empty. 25+ function ops script created

Mandiant Remediation

_

2.0

Mandiant guest ACL feedback preparation, SIEM report reproduction, findings documentation

ISE Policy / General Support

_

1.5

ISE endpoint flapping follow-up (INC-2026-04-16) — 2 endpoints reassigned via ERS API (DELETE+POST and PUT methods). PUT vs DELETE+POST pattern documented

Documentation / Admin

_

1.5

14 encrypted project data directories under d001/projects/ — new security standard for sensitive artifacts. Codex updates: age encryption, xargs+git pipelines

Total

8.0

MSCHAPv2 to EAP-TLS Migration

_

2.5

MSCHAPv2 10:30 meeting — platform ownership matrix captured (8 platforms: GPOs, SCCM, Workspace ONE, Intune, JAMF, Vocera, Chrome, Wyse). Weekly Wednesday cadence call to schedule

ISE Policy / General Support

_

2.0

ISE DataConnect deep dive — multi-table SQL joins (auth methods, identity groups, RADIUS, profiler data). 10,387-line examples file. ISE analytics domain-agnostic reference created

Change Management

_

1.5

CR-2026-04-15 SRT VLAN submitted to iTrack. CAB presentation scheduled for 4/21 15:00. Architecture diagram and change plan finalized

ISE Hardware Refresh

_

1.0

ISE disaster recovery project scaffolded (P0) — DR priority ranking: ISE > Firewalls > Core switches > WLCs > DNS > SIEM. Node roles, critical-auth VLAN, restore procedures

QRadar → Sentinel / Monad

_

1.0

QRadar analysis runbook streamlined, QRadar-to-Sentinel collection updated. AQL query URL encoding techniques documented

Total

8.0

ISE Policy / General Support

3.0

2.0

3.5

4.5

2.0

15.0

Abnormal Security (ESA→EOP)

1.0

2.5

2.0

—

—

5.5

Change Management

—

1.5

2.5

—

1.5

5.5

Meetings

3.0

—

—

—

—

3.0

MSCHAPv2 to EAP-TLS Migration

—

—

—

—

2.5

2.5

Mandiant Remediation

—

—

—

2.0

—

2.0

QRadar → Sentinel / Monad

1.0

—

—

—

1.0

2.0

Documentation / Admin

—

2.0

—

1.5

—

3.5

ISE Hardware Refresh

—

—

—

—

1.0

1.0

Daily Total

8.0

8.0

8.0

8.0

8.0

40.0

ISE Policy / General Support

_

3.0

Standards framework — 20 RFC 2119 standards across 5 domains (Operations, Documentation, Security, AI, Workflow). Quality audit 400/400 criteria

Mandiant Remediation

_

2.0

Mandiant security remediation project — January pentest findings consolidated, evil twin ACL design, CVE-2026-20029 ISE XXE patching, dACL enforcement workstream

QRadar → Sentinel / Monad

_

1.5

QRadar → Sentinel restructure — converted to full project standard, 5 new partials, metadata/summary/overview

Documentation / Admin

_

1.5

16 spoke repo conversions to project standard, certification restructure, project management tooling

Total

8.0

ISE Policy / General Support

_

4.0

General support — carry-forward item triage, ISE patch status verification, project portfolio review

Documentation / Admin

_

2.0

Work priorities documentation, repo synchronization, deployment verification

Meetings

_

2.0

Team coordination, project status updates

Total

8.0

ISE Policy / General Support

_

4.0

General support — MSCHAPv2 migration planning continuation, endpoint report tooling preparation

Abnormal Security (ESA→EOP)

_

2.0

ESA → Abnormal Security evaluation — integration model research, cutover timeline assessment

Documentation / Admin

_

2.0

Work project tracking, blocker dashboard updates, certification progress tracking

Total

8.0

Meetings

_

3.0

Manager 1:1 with Sarah Clizer — 8 project status review (Mandiant P0, Linux Research P0, iPSK Manager P0, MSCHAPv2 P0, CHLA Antora P1, SIEM Migration P1, ISE 3.4 P1, ISE HW Refresh P1)

Mandiant Remediation

_

2.0

Mandiant Q2 assessment timeline discussion, dACL enforcement status, posture/ACL remediation planning

MSCHAPv2 to EAP-TLS Migration

_

1.5

Migration planning review — resource allocation discussion, Chromebook + Wyse wave scoping

ISE Policy / General Support

_

1.5

ISE patch verification, k3s NAT blocker review (31 days), Wazuh indexer recovery status

Total

8.0

ISE Policy / General Support

_

3.0

ISE codex restructure — promoted 7 POSIX tools to top-level categories, created 6 new tool codexes, updated STD-016. Operational reference material for ISE troubleshooting

Documentation / Admin

_

2.0

Build error fixes — unescaped pipes in tables, attribute warnings, 19 broken xref references after directory rename

QRadar → Sentinel / Monad

_

1.5

jq infrastructure queries (7 levels) — progressive examples from select() to multi-source joins for SIEM data processing

Linux Research / Server Deployment

_

1.5

Python dashboard suite — system inventory DataFrames (906 packages, 118 services, network interfaces, routes, ports). Infrastructure visibility tooling

Total

8.0

ISE Policy / General Support

3.0

4.0

4.0

1.5

3.0

15.5

Documentation / Admin

1.5

2.0

2.0

—

2.0

7.5

Mandiant Remediation

2.0

—

—

2.0

—

4.0

QRadar → Sentinel / Monad

1.5

—

—

—

1.5

3.0

Meetings

—

2.0

—

3.0

—

5.0

Abnormal Security (ESA→EOP)

—

—

2.0

—

—

2.0

MSCHAPv2 to EAP-TLS Migration

—

—

—

1.5

—

1.5

Linux Research / Server Deployment

—

—

—

—

1.5

1.5

Daily Total

8.0

8.0

8.0

8.0

8.0

40.0

Documentation / Admin

_

5.0

domus-captures cleanup — orphan page removal, template library (16 templates), nav structure repair, build warning triage

ISE Policy / General Support

_

3.0

ISE documentation review, Antora build verification, deployment fix (domus-docs playbook correction)

Total

8.0

Documentation / Admin

_

5.0

Documentation tooling — Ollama API doc endpoints (markdown converter, linter, session-to-worklog, summarizer), system maintenance

ISE Policy / General Support

_

3.0

ISE documentation infrastructure review, project tracking updates, carry-forward item triage

Total

8.0

MSCHAPv2 to EAP-TLS Migration

_

2.5

Team meeting — leadership requesting netapi endpoint reports with pandas graphs, migration wave identification (Chromebooks + Wyse = ~2,000 endpoints)

QRadar → Sentinel / Monad

_

2.0

Microsoft Sentinel onboarding — Azure portal access, first KQL queries, log source schema review. QRadar migration lead role confirmed

ISE Policy / General Support

_

1.5

Vocera/Wyse iTrack RCA — TAC found RabbitMQ CPU spike on primary MnT, no definitive root cause. Endpoint mitigation via onboard identity group

Abnormal Security (ESA→EOP)

_

1.0

New project assigned — ESA → Abnormal Security API migration. Initial scope assessment

Linux Research / Server Deployment

_

1.0

Enterprise Linux 802.1X standardization — CISO concern about central management, DACL/VLAN assignment gaps

Total

8.0

ISE Policy / General Support

_

3.0

netapi ERS client modularization — split 5,091-line monolith into 15 mixin files, 113+ methods, Sphinx/Furo API docs for team review

ISE Policy / General Support

_

2.0

GCC ISE engagement — 3/4 nodes restored (password recovery + cert verification), PSN-04 deferred. TAC-2026-04-gcc-ise-cert-import documented

Abnormal Security (ESA→EOP)

_

1.5

PRJ-abnormal-security scaffolded — Cisco ESA → Abnormal API migration project scope and timeline

Azure Legacy Migration

_

1.5

PRJ-dmz-migration — external services audit behind NetScaler, DMZ assessment scoping

Total

8.0

ISE Policy / General Support

_

4.0

Codex system buildout — 204 production-grade code snippets across 18 domains (bash, python, powershell, networking, security). ISE operational reference material

Documentation / Admin

_

2.0

Project tracking, carry-forward triage, work priorities documentation

MSCHAPv2 to EAP-TLS Migration

_

2.0

Migration planning — endpoint report preparation, pandas graph requirements scoping

Total

8.0

ISE Policy / General Support

3.0

3.0

1.5

5.0

4.0

16.5

Documentation / Admin

5.0

5.0

—

—

2.0

12.0

MSCHAPv2 to EAP-TLS Migration

—

—

2.5

—

2.0

4.5

QRadar → Sentinel / Monad

—

—

2.0

—

—

2.0

Abnormal Security (ESA→EOP)

—

—

1.0

1.5

—

2.5

Linux Research / Server Deployment

—

—

1.0

—

—

1.0

Azure Legacy Migration

—

—

—

1.5

—

1.5

Daily Total

8.0

8.0

8.0

8.0

8.0

40.0

Documentation / Admin

_

4.0

Sustainable worklog system implementation — 7 section partials + 3 checkbox partials, modular architecture reducing daily worklogs from ~300 to ~50 lines

ISE Policy / General Support

_

3.0

Carry-forward backlog — Strongline Gateway status, k3s NAT verification, Wazuh indexer, Monad pipeline evaluation coordination

QRadar → Sentinel / Monad

_

1.0

Monad evaluation — continued pipeline testing and input source validation

Total

8.0

Documentation / Admin

_

4.0

AsciiDoc mentoring session — kramdoc (markdown→AsciiDoc) conversion, document structure, cross-references, Antora integration basics

ISE Policy / General Support

_

2.0

Carry-forward professional backlog review, ISE TAC case monitoring (S2 post-reboot), task prioritization

QRadar → Sentinel / Monad

_

2.0

Claude Code Features project — data pipeline YAML architecture (92 projects, 8 categories), automation planning for Monad integration

Total

8.0

ISE Policy / General Support

_

4.0

Carry-forward backlog — Strongline Gateway verification, ISE TAC case S2 monitoring, Vocera EAP-TLS follow-up, pending ISE Patch 9 coordination

Documentation / Admin

_

2.0

AsciiDoc mentoring carryover topics — document structure, tables, code blocks, cross-references

Change Management

_

2.0

CR documentation — dots-quantum tmux package change request, stow compatibility audit methodology (applicable to CHLA config management)

Total

8.0

ISE Policy / General Support

_

3.0

netapi security hardening — patched 4 Dependabot vulnerabilities (cryptography, pyasn1, requests, python-socketio), unified exception hierarchy

QRadar → Sentinel / Monad

_

2.0

netapi test infrastructure — pytest fixtures, 18 ISE ERS unit tests, mock API responses, 22% coverage on ERS client

Documentation / Admin

_

2.0

Carry-forward backlog review (8 items, 9-16 days carried), AsciiDoc mentoring topics remaining, work priority assessment

ISE Policy / Change Management

_

1.0

Nav-explore enhancement planning — antora.yml attribute requirements for 16 components, blocked item documentation

Total

8.0

ISE Policy / General Support

_

4.0

Carry-forward backlog — ISE TAC case S2 monitoring, Strongline Gateway verification, Monad pipeline status, Wazuh indexer recovery coordination

Documentation / Admin

_

2.0

Shell Scripting Guide structure — 23 chapter study templates, combined study plan for Linux Bible + Shell Scripting Guide, AsciiDoc grep patterns reference

CISSP Study / Admin

_

2.0

DELE C1 Spanish lesson prep and session — subjunctive clauses, discourse connectors, essay structure review (cross-training communication skills)

Total

8.0

ISE Policy / General Support

3.0

2.0

4.0

3.0

4.0

16.0

Documentation / Admin

4.0

4.0

2.0

2.0

2.0

14.0

QRadar → Sentinel / Monad

1.0

2.0

—

2.0

—

5.0

Change Management

—

—

2.0

1.0

—

3.0

CISSP Study / Admin

—

—

—

—

2.0

2.0

Daily Total

8.0

8.0

8.0

8.0

8.0

40.0

ISE Policy / General Support

_

4.0

ISE incident prep — stakeholder defense points for CISO/leadership (Sarah Clizer, Jonathan Carr, Albert Rodriguez), TAC case S2 status, PSN auth validation

ISE Policy / Change Management

_

2.0

Strongline Gateway VLAN remediation — 8 devices in wrong ISE identity group, CSV import misassignment, incident documentation (INC-2026-03-16)

QRadar → Sentinel / Monad

_

1.0

Monad Pipeline evaluation prep — quick diagnostic commands, pipeline input source research

Documentation / Admin

_

1.0

Comprehensive backlog audit — 8 professional tasks catalogued with days-carried metrics, regex drill system completion

Total

8.0

ISE Policy / Change Management

_

3.0

Strongline Gateway VLAN fix (blocking Arin) — identity group reassignment for 8 devices, ISE endpoint verification

ISE Policy / General Support

_

2.0

k3s NAT verification (8 days carried) — NAT rule 170 for 10.42.0.0/16 pod network, Wazuh indexer recovery coordination

QRadar → Sentinel / Monad

_

2.0

Monad Pipeline evaluation (6 days carried) — pipeline creation testing, input source validation

Documentation / Admin

_

1.0

PeopleSoft time entry system creation — project codes table, activity baselines, biweekly tracking template

Total

8.0

Documentation / Admin

_

3.0

PeopleSoft time entry (CRITICAL) — scalable time tracking system, 4 project codes mapped (Recognition Kiosk, Spectrum/GetWell, Secure Endpoint, Win11 Hardening)

ISE Policy / Change Management

_

2.0

Strongline Gateway VLAN — continued remediation, ISE endpoint group verification, Arin coordination

ISE Policy / General Support

_

2.0

k3s NAT verification (9 days), Wazuh indexer recovery coordination, carry-forward task triage

QRadar → Sentinel / Monad

_

1.0

Monad quick start — pipeline listing, input source search for Cisco integrations

Total

8.0

ISE Policy / General Support

_

4.0

Carry-forward backlog attack — Strongline Gateway follow-up, k3s NAT verification (10 days), Wazuh recovery coordination

QRadar → Sentinel / Monad

_

2.0

Monad Pipeline evaluation (8 days carried) — continued pipeline creation testing, input/output configuration

Documentation / Admin

_

2.0

Professional backlog audit, PeopleSoft time reconciliation, task prioritization review

Total

8.0

ISE Policy / General Support

_

4.0

Carry-forward items — Strongline Gateway VLAN verification (4 days), k3s NAT verification (11 days), Wazuh indexer status check

QRadar → Sentinel / Monad

_

2.0

Monad Pipeline evaluation (9 days) — continued testing, pipeline management commands

Documentation / Admin

_

2.0

Backlog review, carry-forward item documentation, work priority reassessment

Total

8.0

ISE Policy / General Support

4.0

2.0

2.0

4.0

4.0

16.0

ISE Policy / Change Management

2.0

3.0

2.0

—

—

7.0

QRadar → Sentinel / Monad

1.0

2.0

1.0

2.0

2.0

8.0

Documentation / Admin

1.0

1.0

3.0

2.0

2.0

9.0

Daily Total

8.0

8.0

8.0

8.0

8.0

40.0

ISE Policy / General Support

_

5.0

ISE deployment review, VyOS zone-based firewall architecture study (cross-platform NAC knowledge), NAT rule analysis for pod networking

QRadar → Sentinel / Monad

_

2.0

Monad pipeline evaluation prep — research input sources, transform architecture, pipeline management

Documentation / Admin

_

1.0

Open-source NAC alternatives research (PacketFence, FreeRADIUS) — ISE feature gap analysis

Total

8.0

ISE Policy / General Support

_

8.0

General support, carried-over task review, Vault HA failover verification, vault-backup SELinux fix, vault-ssh-sign HA update

Total

8.0

MSCHAPv2 to EAP-TLS Migration

_

3.0

Vocera EAP-TLS supplicant fix — ~10 phones failing 802.1X, MAC lookup queries, ISE DataConnect auth history, bulk CoA reauth prep

QRadar → Sentinel / Monad

_

2.0

Monad CLI enhancement — 7 new commands (input-create, quick-pipeline, graph, health, clone, watch, inputs --type filter)

ISE Policy / General Support

_

2.0

ISE TAC case prep expansion — certificate diagnostics, time-based analysis, VLAN analysis, security analysis, EAP method analysis (+1192 lines)

Documentation / Admin

_

1.0

netapi git forge CLI integration (GitHub/GitLab/Gitea) — 65 commands with -f json support for automation

Total

8.0

ISE Policy / General Support

_

4.0

CHLA ISE TAC Case S1 — ~500 endpoints failing 802.1X, Primary MNT RabbitMQ at 109% CPU, node reboot, post-reboot validation, ECCRB submission

MSCHAPv2 to EAP-TLS Migration

_

2.0

EAP-TLS chain fix investigation — client cert missing intermediate CA, ISE error 5411/12935 analysis, cert chain validation

Documentation / Admin

_

1.0

TAC case documentation — D2 deployment diagram, MNT diagnostics added to ise-tac-case-prep.adoc

ISE Policy / General Support

_

1.0

Security hardening audit — exposed Docker ports (Redis 6379, PostgreSQL 5432), rpcbind on 0.0.0.0:111 identified and fixed

Total

8.0

MSCHAPv2 to EAP-TLS Migration

_

4.0

WiFi DHCP failure RCA — root cause identified: IP conflict + MAC randomization breaking ISE session tracking. RCA-2026-03-13-001 created

ISE Policy / General Support

_

2.0

WPA2-PSK fallback connection documented for EAP-TLS infrastructure outages, nmcli reference section created

Documentation / Admin

_

2.0

First RCA document using case-studies template, backlog audit and carryover triage

Total

8.0

ISE Policy / General Support

5.0

8.0

2.0

5.0

2.0

22.0

MSCHAPv2 to EAP-TLS Migration

—

—

3.0

2.0

4.0

9.0

QRadar → Sentinel / Monad

2.0

—

2.0

—

—

4.0

Documentation / Admin

1.0

—

1.0

1.0

2.0

5.0

Daily Total

8.0

8.0

8.0

8.0

8.0

40.0