reiderer
Hi, I'm Juan Rodríguez
Systems administrator · Cybersecurity analyst · AD · Microsoft 365 · Wazuh · SIEM
I spend my time keeping Microsoft environments up and secure: Active Directory, GPO, Entra ID, Intune and Microsoft 365. The other half I’m on the detection side, with SIEM, vulnerabilities and response. This is where I write about what I build and what I run into along the way.
About me
I’m Juan, a systems administrator with one foot firmly in defensive security. I studied ASIR (a Spanish network systems administration degree) and where I feel most at home is the Microsoft world: Active Directory, GPO, Entra ID, Intune and Microsoft 365.
I started out triaging alerts in a 24/7 SOC and later ended up looking after security for a domain of about a thousand machines with Wazuh, GLPI and GPO. One thing stuck with me from that time: an alert isn’t worth much unless it ends in something concrete, whether that’s a patch rolled out, a ticket someone owns or a rule that finally stops making noise.
reiderer is my logbook. I build labs here that are as close to a real environment as I can get and write down what I learn. Right now I’m on BTL1, very hands-on blue team (phishing, forensics, SIEM, incident response), and I’ve also got my eye on eCPPT. About 30% of its exam is attacking Active Directory, and I really want to see from the other side what I’ve been defending.
And if there’s one thing I’m sure of, it’s that this isn’t about collecting tools or dashboards. It’s about really understanding what’s in front of you and telling signal from noise.
Cases & Labs
Each card covers what the problem was, what I did and what changed. The real cases come from jobs at companies and I tell them without client data. The labs are my own and their code is public.
Patching browsers across a whole domain
ProblemThe SIEM flags a critical Chrome CVE across much of the fleet, with no central update mechanism in place.
Official Chrome and Firefox ADMX templates, an auto-update GPO piloted on a security group and then rolled out to the whole domain.
Result144 High vulnerabilities closed in 3 hours during the pilot.
Read the case →Wazuh alerts turned into tickets
ProblemVulnerabilities and SCA findings sat on the SIEM dashboard with no owner and no follow-up.
Python integration with the GLPI REST API: least-privilege service account, deduplication and a custom rule to detect unauthorized software.
ResultCritical alerts, CVEs and SCA failures land in the support queue automatically, without duplicates.
Read the case →SSO with Keycloak for GLPI and Moodle
ProblemEvery internal app with its own password and its own joiner/leaver process.
OIDC authentication with PKCE against Keycloak, with automatic account creation disabled, after reviewing the plugin’s source code before installing it.
Result3,600+ users migrated in Moodle and SSO validated on three GLPI instances.
Memory leak in Xibo Player
ProblemDigital signage screens reaching 12-14 GB of RAM and 100 °C CPU until they went black.
Rebuilt the player (C++, GTK, GStreamer) on Ubuntu 24.04 and changed its architecture: one video pipeline per region instead of one per video, with rollback and Zabbix monitoring.
ResultMemory stable at 42-48 MB and CPU down from 95-105 °C to 61-63 °C on three devices.
Read the case →Microsoft 365 deployment at scale
ProblemA company joining an international group with a heterogeneous Windows fleet.
Provisioning with Windows Autopilot, identities in Entra ID, and compliance and endpoint security policies in Intune.
Result230+ endpoints migrated to Microsoft 365.
Microsoft Sentinel SOC Lab
ProblemHow do you catch persistence in cloud identity before it becomes an incident?
SIEM in Azure with the Entra ID connector, KQL analytic rules mapped to MITRE ATT&CK, an identity threat workbook and a Logic Apps notification playbook.
ResultDetection of account creation (T1136.003) and role assignment (T1098.003) with incident and automated response.
View on GitHub →Wazuh SIEM Lab
ProblemWhat does a SIEM actually see when a vulnerable server is attacked?
Wazuh monitoring Metasploitable3 with Kali as the attacker: custom XML rules, ATT&CK technique detection and VirusTotal integration.
Result22 CVEs inventoried and prioritized by CVSS; attacks detected and correlated.
View on GitHub →M365 Admin Toolkit
ProblemManual Microsoft 365 onboarding/offboarding: forgotten licenses and sessions left alive.
PowerShell module on Microsoft Graph for the user lifecycle and MFA, license and inactive-account reports, with -WhatIf on everything that touches accounts.
ResultPester tests and GitHub Actions CI with PSScriptAnalyzer.
View on GitHub →Resilient infrastructure
ProblemCompute, observability and data protection are rarely learned together.
Proxmox VE homelab with OPNsense, Active Directory, Zabbix and backups with Veeam and Proxmox Backup Server, documented phase by phase.
ResultHypervisor, firewall, domain and DHCP up; the Docker host closes phase 2.
View on GitHub →High availability cluster
ProblemA web service with a database that can’t go down when a node does.
Pacemaker and Corosync on Debian, MariaDB behind ProxySQL and monitoring with Prometheus and Grafana.
ResultAutomatic failover between nodes with no manual intervention.
View documentation →DarkHole: 1
Web enumeration, SQL injection and privilege escalation via SUID binaries, with internal service analysis.
View write-up →Psycho: 1
Thorough enumeration, LFI exploitation, log analysis and privilege escalation through scripts with special permissions.
View write-up →Road to eCPPT
Active Directory pentesting, post-exploitation and lateral movement. Attacking the kind of environment I administer to learn what my logs show and what they miss.
Blog
reiderer is, above all, a log. Here I post what I learn, what I build and what I think about systems and security.
144 vulnerabilities in 3 hours: patching browsers across a whole domain with GPO
Wazuh lit up red over a critical Chrome CVE across half the fleet. I could have put out the fire with a script, but I preferred to fix why it had started.
SystemsThe screen that ate 14 GB of RAM: debugging Xibo Player in C++
A digital signage screen that went black every few hours. I ended up reading the player’s C++ code, and there it was: one video pipeline per video, and none of them ever freed.
Blue TeamFrom alert to ticket: connecting Wazuh to GLPI
Wazuh was detecting fine, but alerts died on the dashboard. Here is how I built an integration so the important ones end up in GLPI with an owner, without duplicates and with just enough permissions.
Blue TeamIncident response: a WordPress webshell and the two nobody had seen
The hosting provider reported an attack, and the malicious plugin was right where they said. The interesting part came when I kept looking: two more backdoors, years old.
How I work
Whether I’m building a server or looking at an alert, I try to work the same way. Understand first, then prioritize, and write everything down.
Understand before touching
Before running anything I like to know what the system exposes, how it’s put together and what’s around it.
Pilot before rolling out
First a small group I can measure and, if it goes well, everyone else. And if a change can’t be undone, it doesn’t go out on a Friday.
Prioritize, don’t pile up
I’m not obsessed with having more rules or more sources. I’d rather have fewer and understand them properly.
From alert to action
If nobody’s handling an alert, it’s noise. What I care about is it ending up as a ticket, a patch or a better-tuned rule.
Document the process
I write everything down so someone else can review it, repeat it or understand it without having to ask me.
Least privilege, me included
Service accounts with just the permissions they need, passwords out of the code and every change leaving a trail.
Experience
Certifications
I’m on a purple team path: security basics first, then some offense, and now it’s time for hands-on defense.
BTL1 Blue Team Level 1
A 24-hour practical exam covering phishing analysis, forensics, SIEM, threat intelligence and incident response. My next step.
eCPPT Certified Professional Penetration Tester
A fully practical exam where almost a third is about attacking Active Directory. The very environment I know from the inside.
Path: Security+ → eJPTv2 → BTL1 → eCPPT. The Microsoft 365, Entra ID and Intune side I learned by working with it in production.
Recommendations
From the start of ASIR, Juan showed great interest in cybersecurity. He always went a step further, learning on his own. Very dynamic, with a constant drive to improve.
Juan stood out for his interest and curiosity in cybersecurity. Always learning on his own, beyond class. Very proactive and eager to keep improving.
Let's talk systems and security
reiderer is my place to share what I build and what I learn in systems and security. If you want to discuss a case, propose a collaboration or just connect, here I am.