https://solo10010.github.io/en/blog/Recent content in Blog onHugo -- gohugo.ioen-USTue, 06 Oct 2020 08:49:55 +0000https://solo10010.github.io/en/blog/qyran/Mon, 02 Nov 2026 20:00:00 +0500https://solo10010.github.io/en/blog/qyran/Qyran (Kazakh Қыран — golden eagle) is my self-hosted platform for bug bounty and security audits. It ties dozens of recon and scanning tools into one process, stores everything in a shared database, shows results in a convenient panel and brings in AI agents where analysis is needed. This article covers why it exists, the attempts that led to it, and how it works inside. The source code is closed.https://solo10010.github.io/en/blog/plesk-admin-cheat-sheet/Mon, 02 Nov 2026 23:00:00 +0500https://solo10010.github.io/en/blog/plesk-admin-cheat-sheet/On first- and second-line hosting support, Plesk is everyday work. In my Obsidian vault the Plesk section grew to about fifty notes: from “why isn’t mail going out” to attaching a LUN larger than 2 TB. Here is the essence — the commands that actually came in handy most often. All examples are anonymized: example.com, user@example.com, ID — substitute your own. Everything below runs as root over SSH. Before any bulk operation — deleting mail, files or backups — first check what the command will hit, and only then delete.https://solo10010.github.io/en/blog/obsidian-para/Mon, 02 Nov 2026 22:30:00 +0500https://solo10010.github.io/en/blog/obsidian-para/Almost every article on this blog grew out of my notes. I joined a hosting company as a first-line sysadmin and wrote everything down from day one: commands, incident write-ups, ticket solutions, course notes. Later came security, Active Directory, SIEM, bug bounty. Today the vault holds about 4,800 notes — and finding the right one takes seconds. I spent months on the structure, reworking it several times. Why PARA Tiago Forte’s PARA method splits everything into four groups by level of activity rather than by topic:https://solo10010.github.io/en/blog/second-brain-ai/Mon, 02 Nov 2026 22:00:00 +0500https://solo10010.github.io/en/blog/second-brain-ai/I described how the vault itself is organized in How I organized my notes in Obsidian: PARA. This is the next step: how AI tools are connected to it and what work they took over. The problem: writing is easy, sorting isn’t I got used to writing in Obsidian long ago. The bottleneck was elsewhere: the inbox fills up faster than I can sort it; notes of different ages are formatted differently; to answer “how did I do this before” you have to remember where the note is; every new AI chat starts from zero — you have to explain the context again.https://solo10010.github.io/en/blog/ai-agent-costs/Mon, 02 Nov 2026 21:30:00 +0500https://solo10010.github.io/en/blog/ai-agent-costs/When I started building AI agents into my bug bounty platform Qyran, the first shock wasn’t the models' intelligence but the bills. An agent told to “just check the site” happily reads megabytes of logs, reruns the same commands ten times and drags the entire conversation history into every request. Subscriptions to top models cost around $200 a month, and pay-as-you-go API usage without control burns money even faster. In the end a full target scan in Qyran costs about one dollar.https://solo10010.github.io/en/blog/ollama-open-webui/Mon, 02 Nov 2026 21:00:00 +0500https://solo10010.github.io/en/blog/ollama-open-webui/Cloud models are convenient, but in security you constantly deal with things that can’t be sent outside: logs, configs, customer data, audit results. For those tasks I keep a local LLM: the model runs on my own server, and not a single byte goes to a third-party provider. The setup is simple — Ollama runs the models, Open WebUI provides a ChatGPT-like web interface. Hardware requirements What Minimum OS Linux, e.https://solo10010.github.io/en/blog/siem-alert-noise/Mon, 02 Nov 2026 18:00:00 +0500https://solo10010.github.io/en/blog/siem-alert-noise/Deploying a SIEM is only half the job. A couple of months after launching Wazuh I took a snapshot and realized that watching the dashboard was pointless: alerts poured in at dozens per second, and what the whole thing was built for got lost among them. This article breaks down that snapshot and the model I use to turn a firehose into an incident queue. I described how the cluster itself is built in Building a SOC on Wazuh from scratch.https://solo10010.github.io/en/blog/business-email-compromise-investigation/Mon, 02 Nov 2026 17:00:00 +0500https://solo10010.github.io/en/blog/business-email-compromise-investigation/The ticket looked routine: “A strange email went out from our mailbox to someone, please check.” It turned out that attackers had access to three corporate mailboxes for more than a week, downloaded the mail and received a copy of every new message. Below is how the picture was reconstructed from mail server logs, and what any company should take away from it. The incident is fully anonymized: no organization names, addresses, IPs or exact dates.https://solo10010.github.io/en/blog/active-directory-cis-benchmark/Mon, 02 Nov 2026 16:00:00 +0500https://solo10010.github.io/en/blog/active-directory-cis-benchmark/An office of about a hundred people, computers in a workgroup, everyone a local administrator, passwords “whatever is convenient”, software installed however people liked. A familiar picture for a company that grew faster than its IT. That is where building information security started: until you have a managed domain, everything else — antivirus, SIEM, audits — is built on sand. Domain, account and group names, as well as specific exceptions, are replaced with placeholders.https://solo10010.github.io/en/blog/wazuh-soc-from-scratch/Mon, 02 Nov 2026 10:00:00 +0500https://solo10010.github.io/en/blog/wazuh-soc-from-scratch/When a company runs hundreds of servers hosting thousands of customer websites, attacks never stop: password brute force, scanning, web shell uploads, CMS exploits. Without centralized monitoring you learn about a breach from a customer or an abuse report. I came to security from system administration and built a SOC at a hosting company from scratch. This article covers what came out of it, how it works, and the mistakes I made along the way.