I locked the doors before I hung the cameras.

There is a rite of passage in building a security lab, and it is not the fun part. Before you get to hunt for intruders, you have to stop being your own intruder. My automation was talking to a remote Ubuntu server over SSH (the encrypted remote-login channel, the tunnel you use to run commands on a machine that lives somewhere else) and that server runs Splunk Enterprise, the log-crunching engine at the heart of the lab. The problem was how my scripts were logging in. They were shoving a password down the pipe.

Three Python scripts were doing the same ugly thing: echo '{password}' | sudo -S, which literally pipes your admin password as plain text into a privileged command. Two problems, one pattern. The obvious one is that the password now lives in a command string where anything can read it, which is exactly the credential hygiene sin you are supposed to avoid: not leaving keys and passwords lying around. The subtler one is that this pattern looks so much like malware that it tripped my endpoint protection, which is the loose thread from an earlier Windows Defender false-positive investigation I still owed a fix on.

Killing the password out of the pipeline

The fix is the correct one, and it is old and dull, which is how you know it is right. Swap password login for key-based authentication: generate a cryptographic key pair, keep the private half on my machine, plant the public half on the server, and let the math prove who I am instead of a secret I have to keep typing. Then remove the need for a password on the privileged side entirely with passwordless sudo, scoped to the one automation user. No password anywhere in the pipeline means nothing to leak and nothing to look like malware.

The three offenders, ssh_diag.py, ssh_fix_secondbrain.py, and ssh_fix2.py, were rewritten to let paramiko (the Python SSH library) find the key on its own, so the password piping is simply gone. Then I closed the Defender thread properly: the earlier Trojan:Win32/Leonem!rfn alerts came back confirmed resolved, and I added a folder exclusion scoped to exactly the automation scripts directory and nothing wider. That last restraint matters. A broad exclusion would have been easier and would have blinded Defender across half my work. Least privilege means you carve the smallest hole that solves the problem.

Then I gave the lab its first eyes

Doors locked, now the cameras. A SOC dashboard (security operations center, the at-a-glance view a security team stares at all day) is where you go to see, in one screen, what is happening across your network. Mine lives inside the SIEM, the log-search-and-alert system, in this case Splunk, that hoovers up event logs and lets you query them. The lab had already been quietly collecting: 30,909 Windows event-log records were sitting in there waiting for someone to actually look at them, the bulk of them (28,577) security events, with system and application logs making up the rest.

So I built a four-panel dashboard aimed at the one question that matters most in a Windows Active Directory domain: who is logging in, and should they be? Each panel is a saved search over the exact events that tell that story.

The point of a first dashboard is not to catch an attacker on day one. It is to learn what normal looks like, so abnormal has something to stand out against. The failed-login panel found just two attempts, both from the VirtualBox host adapter on my own box, which is exactly the quiet you want: any real spike in failures would now mean someone is guessing passwords. The successful-login panel filters out machine-to-machine noise (the accounts ending in $, which are computers, not people) so only human logins surface, and the only human here is Administrator. The privileged-activity panel, machine accounts stripped out the same way, shows Administrator with 74 privilege grants across old sessions, which is boring, and boring is correct. The last panel just plots logins over time, and its bursts track exactly when I was working the lab, flat where the virtual machines were switched off.

Why the dull half is the real half

If you are reading this to size me up, here is the honest shape of it. Neither of these tasks is a headline. One was deleting passwords from three scripts; the other was four saved searches on a screen. But this is the work that everything else stands on. The hardening shrinks the attack surface and quiets the false alarms that were burying the real signal. The dashboard turns a pile of 30,909 unread logs into something a human can actually watch. Locking the doors and hanging the cameras, in that order, on purpose, because the interesting security work is meaningless until both are done.