In addition to monitoring, managing VMs is a key task for administrators. Below are simple PowerCLI commands for cloning and deleting VMs.

Cloning a VM

$sourceVM = Get-VM -Name "template-vm"
$targetHost = Get-VMHost -Name "esxi-host-01"
$datastore = Get-Datastore -VMHost $targetHost | Where-Object {$_.Name -like "vsanDatastore"}

New-VM -Name "cloned-vm" `
       -VM $sourceVM `
       -VMHost $targetHost `
       -Datastore $datastore `
       -ResourcePool ($targetHost | Get-ResourcePool)

Deleting a VM

Get-VM -Name "cloned-vm" | Remove-VM -DeletePermanently -Confirm:$false

These commands are especially useful for lab environments or when automating template-based VM provisioning.

---

Conclusion Use this PowerShell command as part of your regular cluster health checks. When combined with vCenter’s vSAN resync and health dashboards, it gives you the full picture to maintain optimal performance and avoid storage imbalances.

Stay tuned for a follow-up post on triggering manual rebalancing using RVC (Ruby vSphere Console).

© 2012–2025 Jet Mariano. All rights reserved.
For usage terms, please see the Legal Disclaimer.

Introduction: Keeping your vSAN environment healthy and balanced is critical to maintaining performance and avoiding bottlenecks. One of the best ways to stay ahead of potential issues is by proactively monitoring your ESXi host’s CPU and memory usage using PowerShell and PowerCLI. In this post, we’ll walk through a script that provides a quick overview of resource usage across your vSAN cluster — a valuable step before deciding whether to initiate a manual rebalance.

---

PowerShell Script to Monitor vSAN Host Resource Usage

Get-VMHost | Select Name, `
    @{N="CPU Usage MHz"; E={($_.CpuUsageMhz)}}, `
    @{N="Total CPU MHz"; E={($_.CpuTotalMhz)}}, `
    @{N="Memory Usage GB"; E={[math]::Round($_.MemoryUsageGB, 2)}}, `
    @{N="Total Memory GB"; E={[math]::Round($_.MemoryTotalGB, 2)}}

---

Sample Output

Host Name	CPU Usage MHz	Total CPU MHz	Memory Usage GB	Total Memory GB
esxi-host-01	6,405	115,168	151.94	511.71
esxi-host-02	7,148	115,168	199.02	511.71
esxi-host-03	2,089	115,168	124.49	511.71

---

What This Tells You

• CPU Load: In the sample output, CPU usage is consistently low (<10%), meaning the compute load is healthy.
• Memory Load: Memory usage ranges from ~24% to ~39%, suggesting room for optimization or upcoming load balancing.

---

When to Rebalance

If you see disproportionate usage — for example, one host consistently nearing 80%+ memory while others are underutilized — it may be time to initiate a vSAN rebalance.

This script gives you the confidence to proceed with rebalance safely during production hours, especially when CPU usage is low and no resync activities are ongoing.

---

Conclusion Use this PowerShell command as part of your regular cluster health checks. When combined with vCenter’s vSAN resync and health dashboards, it gives you the full picture to maintain optimal performance and avoid storage imbalances.

Stay tuned for a follow-up post on triggering manual rebalancing using RVC (Ruby vSphere Console).

© 2012–2025 Jet Mariano. All rights reserved.
For usage terms, please see the Legal Disclaimer.

Introduction

In today’s digital landscape, cybersecurity is more than just antivirus software and firewalls—it’s about layered security across endpoints, networks, identities, and applications. With cyber threats evolving daily, businesses must adopt proactive monitoring and defense mechanisms. This is where Security Information and Event Management (SIEM), Application Performance Monitoring (APM), and Privileged Access Management (PAM) come into play.

This guide will cover the importance of these tools, best practices, and how to integrate them with enterprise-grade security solutions like Cisco MX, Cisco Umbrella, CyberArk, and DUO.

---

1. Security Information and Event Management (SIEM)

SIEM solutions aggregate, analyze, and correlate security data from multiple sources, providing real-time visibility into potential threats.

Why SIEM Matters:

• Centralized Log Management: Collects logs from firewalls, servers, endpoints, and applications.
• Threat Detection: Uses AI and correlation rules to identify anomalies.
• Incident Response: Sends alerts when suspicious activity is detected.
• Compliance: Helps meet PCI-DSS, HIPAA, SOX, and Hi-Trust requirements.

Recommended SIEM Solutions:

✅ Splunk – Enterprise-level security analytics.
✅ Microsoft Sentinel – Cloud-native SIEM for Microsoft ecosystems.
✅ DataDog – Lightweight SIEM with cloud integrations.
✅ Elastic SIEM – Open-source alternative.

---

2. Application Performance Monitoring (APM)

APM tools monitor application behavior, uptime, and response times to ensure optimal performance and detect security anomalies.

Why APM Matters:

• Proactive Threat Identification: Detects application-layer attacks.
• Performance Optimization: Reduces downtime and enhances user experience.
• Integration with SIEM: Provides deeper insights into suspicious activity.

Recommended APM Tools:

✅ Datadog APM – Cloud monitoring with SIEM integration.
✅ Dynatrace – AI-powered full-stack monitoring.
✅ AppDynamics – Deep visibility into application health.
✅ SolarWinds APM – Cost-effective solution for IT teams.

---

3. Privileged Access Management (PAM) & Multi-Factor Authentication (MFA)

Privileged accounts are the biggest attack targets. Implementing PAM with MFA ensures that admin accounts are secure.

Why PAM & MFA Matter:

• Least Privilege Enforcement: Restricts admin access to critical systems.
• Prevents Credential Theft: Limits exposure to compromised passwords.
• Logs & Audits: Tracks administrative actions for compliance.

Best Practices:

✅ Use CyberArk for managing privileged accounts.
✅ Require MFA (DUO, Microsoft Authenticator, YubiKey).
✅ Separate Personal & Admin Accounts:

• Personal Account → No admin rights.
• Admin Account → Requires 15-min auto MFA renewal (best practice in enterprises like PIMCO & CNB).

---

4. Endpoint Protection with XDR

Extended Detection & Response (XDR) provides real-time protection across endpoints, emails, and cloud workloads.

Why XDR Matters:

• AI-powered Threat Detection: Blocks malware, ransomware, and phishing attempts.
• Zero Trust Security: Ensures only verified endpoints can access corporate networks.
• SIEM Integration: Sends endpoint logs for analysis.

Recommended XDR Solutions:

✅ Microsoft Defender XDR – Built-in for Microsoft environments.
✅ CrowdStrike Falcon – AI-driven endpoint security.
✅ SentinelOne XDR – Autonomous threat response.

---

5. Network Perimeter Security: Cisco MX & Cisco Umbrella

Firewalls alone are not enough. Organizations need cloud-based DNS security & perimeter defense.

Why Cisco MX & Umbrella Matter:

• Protects Against DNS-layer Attacks (e.g., phishing & malware sites).
• Prevents Data Exfiltration (blocks malicious domains before connections happen).
• Works with SIEM & XDR (for full security visibility).

Best Practices:

✅ Deploy Cisco MX for firewall + SD-WAN security.
✅ Use Cisco Umbrella to block malicious internet traffic.
✅ Segment Networks to isolate critical resources.

---

Conclusion: Security Requires Layered Defense

Cybersecurity isn’t just about one tool—it’s about a layered approach:

1. SIEM for centralized monitoring.
2. APM for app performance & security insights.
3. PAM & MFA for privileged access control.
4. XDR for endpoint protection.
5. Cisco MX & Umbrella for perimeter security.

Implementing these tools reduces risk, improves compliance, and protects IT infrastructure from modern threats.

---

Next Steps:

✅ Read our Step-by-Step Guides for each tool (coming soon).
✅ Explore PowerShell automation for security hardening.
✅ Contact us for enterprise security consulting (if applicable).

🔗 Stay tuned for more guides on securing your IT infrastructure!

---

© 2012–2025 Jet Mariano. All rights reserved.
For usage terms, please see the Legal Disclaimer.

Introduction

In today’s cybersecurity landscape, Security Information and Event Management (SIEM) plays a crucial role in protecting organizations from threats. A robust SIEM system centralizes security monitoring, aggregates logs, detects anomalies, and helps security teams respond to incidents in real time. However, SIEM is only one piece of a comprehensive security framework. To maximize its effectiveness, it should be integrated with other advanced security solutions such as APM tools, privileged access management (CyberArk), multi-factor authentication (Duo), and endpoint detection and response (XDR).

The Role of SIEM in Security

A SIEM system provides the following key functions:

• Centralized Log Management: Aggregates and normalizes logs from different sources.
• Real-Time Threat Detection: Uses correlation rules and AI-driven analytics to detect anomalies.
• Incident Response: Helps security teams investigate alerts and mitigate threats.
• Compliance & Auditing: Meets regulatory requirements for PCI-DSS, HIPAA, SOX, and Hi-Trust.

Recommended SIEM Solutions:

1. Splunk – Market leader in log analysis and threat detection.
2. IBM QRadar – Integrates well with enterprise IT infrastructure.
3. Microsoft Sentinel – Cloud-based SIEM with strong integration into Microsoft’s security ecosystem.
4. LogRhythm – Offers automation and advanced analytics.

Integrating APM Tools for Security & Performance Monitoring

APM (Application Performance Monitoring) tools work alongside SIEM to ensure application security and performance. APM tools help in:

• Detecting performance bottlenecks before they become security vulnerabilities.
• Correlating security events with application behavior.
• Enhancing log visibility for forensic analysis.

Recommended APM Tools:

1. Datadog – Offers monitoring for applications, logs, and security events.
2. Dynatrace – AI-powered analytics for anomaly detection.
3. New Relic – Provides application telemetry and distributed tracing.
4. AppDynamics – Deep visibility into application performance.
5. SolarWinds – A cost-effective alternative with performance monitoring capabilities.

The Importance of CyberArk for Privileged Access Management

Why Privileged Access Management (PAM) Matters? Privileged accounts are the highest-value targets for cybercriminals. CyberArk provides:

• Credential Vaulting – Securely stores and rotates privileged credentials.
• Session Isolation – Prevents direct access to critical systems.
• Least Privilege Enforcement – Ensures users only have access to what they need.
• Audit Logging – Records privileged activity for compliance.

Best Practices: Personal vs. Admin Accounts with Duo MFA

Many enterprises make the mistake of using a single account for both personal and administrative tasks, increasing security risks. Best practices recommend:

• Personal Account for Day-to-Day Use:
  • No elevated privileges.
  • Limited access to sensitive data.
  • MFA enforced for login.
• Admin Account for Privileged Tasks:
  • Protected by Duo MFA with time-based authentication every 15 minutes.
  • Password resets automatically every 15 minutes (e.g., CyberArk enforcement).
  • No direct internet access (restricted browsing and email access).

Endpoint Protection with XDR

Endpoints are the most vulnerable attack surface. Extended Detection and Response (XDR) solutions provide:

• Advanced Threat Detection: AI-driven monitoring for malware, ransomware, and behavioral anomalies.
• Automated Response: Blocks and isolates compromised endpoints.
• Integration with SIEM & SOAR: Security teams can automate investigations and threat responses.

Recommended XDR Solutions:

1. Microsoft Defender XDR – Natively integrates with Microsoft’s security suite.
2. CrowdStrike Falcon XDR – Lightweight agent with cloud-native capabilities.
3. SentinelOne – AI-driven threat hunting.
4. Palo Alto Cortex XDR – Strong perimeter and endpoint defense.

Perimeter Security: Cisco MX & Cisco Umbrella

Perimeter Security & Zero Trust Architecture A properly configured perimeter ensures that malicious traffic is blocked before it reaches endpoints or internal servers.

• Cisco Meraki MX – Next-generation firewall with content filtering, VPN, and IPS/IDS.
• Cisco Umbrella – Cloud-delivered security that blocks malicious domains and phishing attempts at the DNS level.

Conclusion

An effective security framework requires a layered defense strategy that integrates SIEM, APM, PAM, MFA, XDR, and Perimeter Security.

By implementing these solutions, organizations ensure: ✔ Proactive threat detection and response ✔ Regulatory compliance (PCI-DSS, HIPAA, SOX, Hi-Trust) ✔ Minimized attack surface ✔ Reduced impact of security breaches

Cybersecurity is not just about having tools—it’s about implementing the right tools, enforcing best practices, and continuously monitoring for evolving threats. The Force is always within you, but having the right technology stack ensures that you are always prepared for battle.

© 2012–2025 Jet Mariano. All rights reserved.
For usage terms, please see the Legal Disclaimer.

When a team member leaves your organization, it’s critical to offboard them securely and efficiently. Here’s a step-by-step PowerShell-based offboarding process that covers:

✅ Disabling the user in Local Active Directory
✅ Disabling the Azure AD account
✅ Removing all licenses
✅ Disabling MFA
✅ Converting the mailbox to a shared mailbox
✅ Granting full mailbox access to the supervisor

---

Step 1 – Disable the User in Local Active Directory

powershellCopyEditDisable-ADAccount -Identity jdoe

---

Step 2 – Disable Azure AD User Account

powershellCopyEditConnect-AzAccount
Set-AzureADUser -ObjectId [email protected] -AccountEnabled $false

---

Step 3 – Remove Microsoft 365 Licenses

powershellCopyEditConnect-MgGraph -Scopes "User.ReadWrite.All", "Directory.ReadWrite.All"
$UserId = (Get-MgUser -UserId [email protected]).Id
Set-MgUserLicense -UserId $UserId -AddLicenses @() -RemoveLicenses @("tenant:licenseGUID")

📝 Replace tenant:licenseGUID with the appropriate license GUID assigned to your tenant.

---

Step 4 – Disable MFA

powershellCopyEditConnect-MsolService
Set-MsolUser -UserPrincipalName [email protected] -StrongAuthenticationRequirements @()

---

Step 5 – Convert Mailbox to Shared

powershellCopyEditConnect-ExchangeOnline
Set-Mailbox -Identity [email protected] -Type Shared

---

Step 6 – Grant Supervisor Full Access to the Shared Mailbox

powershellCopyEditAdd-MailboxPermission -Identity [email protected] -User [email protected] -AccessRights FullAccess -InheritanceType All

---

Summary

Using PowerShell for offboarding saves time and ensures consistency. Always document changes and communicate them to HR or management for final closure.

© 2012–2025 Jet Mariano. All rights reserved.
For usage terms, please see the Legal Disclaimer.