Kindly overlook my dog’s sudden presence
He’s mischievous
He’s restless
He’s finding a way to escape
All night, he’s been smelling a bitch in heat
I’ll put him back in the yard

Forgive my awkward movement
I had a recent surgery
Prosthetic hip implant
From shaking the sheets
And playing the kettlebells with dumb beats
I’m still getting used to it

I won’t apologize for the rest
If the mess or noise bothers you, leave or ignore it
I’m figuring it out regardless

Just an author’s note

I could say that this poem is influenced by a couple of things, like Nirvana’s “All Apologies” and observing people making polite apologies, though I’m uncertain. I can’t really say where the inspiration came from; the ideas just flowed.

I’m sorry, I’m not sure.

And most apologies are not totally worthless; they’re mostly unproven.

Thank you for reading
Subscribe, comment, and share. It’s all free.
:)

Subscribe now

Leave a comment

Share

If that poem did something to you, here’s another:

For an individual who has enough character or sensitivity to spot that the air is slightly off, that awareness alone makes everything less confusing. That counts as a fair notice. Never ignore it (this is where most people mess up; we tend to get drunk and happy, then become impetuous), as it helps you see the unpleasant mood in the place.

And if you ever deadass spot the non-comforting actors, the hardcore hypocrites and know the deeper contradictions behind the place’s darker elements. Tell yourself this with conviction and haste:

“Whatever this really is, and no matter what happens, I won’t become genuinely corrupt.”

Artwork by Error404ArtistNFound

The rest unfolds on:

Peculiaritorium

Peculiaritorium is about me making sense of reality and discovering its friction points, and if I’m successful, it outgrows my outdated perspective, and maybe yours too. Yet sometimes, it doesn’t outgrow my perspective so much as complicate it, stretch it, twist it or refuse to resolve it at all…and maybe yours too.

:)

Thanks for reading.

Leave a comment

My midday drift with Title Fight ^

At midday, I hold out for the real thing.
Subduing
my memories,
a focused,
steady headspace…
Patiently waiting.

Still, shit in my mind repeats.
Yet so I return to face,
and erase it.
Circling up;
drifting high and away.
Then again,
it weirdly
materializes
abruptly.

Strange as it seems, still, I feel real.
Painfully alive.
Reorienting.
It’s fine.
I relish. I love my own time.
I choose poise.
I choose to become unfazed.
I choose to become real.

I’m being real. You think I cast myself away?
Even in red,
I find soothe,
and style
in being by myself.
I know I’m never blue, never gray—
I’m just drifting my own way.
Maybe…
Yeah, I’m simply holding out for the real thing.

Thank you for reading :)
And it’s the usual process :)

Subscribe now

Leave a comment

Share

© A Peculiar Mixture of Chill and Effort, 2026. All rights reserved.

Dear Girlfriend,

I’ve always been finding a way into your head, to hypnotize you, so I can make you feel like you’re new again. But most of the time (probably every time) I attempt, it feels like a war against a tempest, busting my heart open and pinning me to the ground, leaving me absolutely devastated. Despite being depleted, I still foolishly force myself to drag and lift my flesh and bones, and am still unreasonably drawn to the next meet.

It’s hard to make amends, it’s hard to carry sour hesitation and sweet sincerity at the same time, especially when everything feels shaking, crippling, and the day fades away too fast, like a broken hourglass cheated of its own sand. It makes me wanna say that balance is a scam and that time is indeed an illusion.

As things pace and shuffle quickly, and as me keeping on trying, me going down hard and crawlingly get up repeatedly, it makes me also think I’ve already become a zombie. And maybe that’s what I’m looking like to you. Probably even zombier.

Zombie or just stubborn? Both? Damn, I don’t fully know… fully feel? I simply hate this resilient thing in me that won’t shut down. And at a weird angle, how the fuck does this thing tell me something so wrong and so right? You’re always saying all the wrong parts and the right reasons. And I’m saying the right parts for the wrong reasons? How does it become like this? Why the hell are we fond of swapping clarity and confusion?

Your angry curses, your bitter obscenities, it slashes me deep. Every slash is like receiving the most violent rush of the wind; it goes beyond the flesh, beyond my reasoning, it waves my conscious soul out from my body.

Am I already dead because of these repeated devastating blows?

Am I really already a zombie?

I feel so..? I think so..?

Part of me is already dead, immortal.

I long for better warmth. I favor better smiles. Not moans of pain and raspy breathing. But how could I regain a warm body when the coldest wind continually blows, and darkness is persistently shouting?

Crashing and stubborning. Zombifying.

Still, harsh is an understatement.

I guess this is what happens when the sweetest turn sour. Or maybe it was never sweet to begin with; it’s just a front, and sourness is the true taste underneath. Well, a storm seems calm from afar.

Anyway, it’s weird to taste the wind like this. I prefer watching dogs stick their heads out of the car window, lick the air and drool freely, as they seem to enjoy it. I don’t know, perhaps this is just my tiny amount of warm sensation and bouncing zombie thought. Or maybe, it’s better to be a dog than a zombie… Yeah. agree.

Ssooouuurrrrghhly sweet,

the half-zombie boyfriend

In the next meet, either a zombie or a dog, I’ll be biting hard.
You’ve been warned. HAHArr. Urrgh, wait, relax, zombie brain glitched.

Thank you for reading.

Subscribe, or comment, or share, all for free :)

Subscribe now

Leave a comment

Share

Synaptic transmission is how neurons send electrical signals to one another using chemical messengers (neurotransmitters) across tiny gaps (synaptic clefts).

This is the basis of our thinking, memory, emotions, and movement. This process occurs rapidly across billions of neurons for every idea, feeling and action. It isn’t just happening in the brain, but throughout the entire nervous system.

This plays an essential role in connecting to The Source.

Painted by nydialilian

I.

Smile at your frustrations. You can do that; realize it is a signal to interpret. This’ll lead to fighting your problems with less hate.

II.

You don’t just need silence, you need grooving silence.

III.

Writing makes one feel zen.

IV.

Always get what’s useful.

V.

Focused symmetry can shape harmony, but direction demands imbalance.

VI.

Keep your comedy sharp, because people who hear it will carry it home, repeat it, analyze it, and will still find themselves alone, smiling and chuckling.

VII.

Pray. YHWH.

VIII.

Wu wei

IX.

Three cups of coffee. That’s it — no more.

X.

Always mind your posture.

XI.

Listen to the Smashing Pumpkins. It’ll ease the pain, somehow.

XII.

Sufficient unto the day is the evil thereof

Thank you for giving this a read.
The rest unfolds on:

Peculiaritorium

Peculiaritorium is about me making sense of reality and discovering its friction points, and if I’m successful, it outgrows my outdated perspective, and maybe yours too. Yet sometimes, it doesn’t outgrow my perspective so much as complicate it, stretch it, twist it or refuse to resolve it at all…and maybe yours too.
:)

And if you’re into that, feel free to:

Subscribe now

Leave a comment

Share

I feel there’s a stronger air of annoyance from people who don’t use AI toward those who use AI, especially in writing. My take? Artistry matters, always. It’s worth recognizing the content you’re putting out. Be mindful enough about it. Well, the role of the artist is to put something out from the unknown into existence. Something shaped by personal perception, imagination, and lived experience.

When AI is relied upon heavily, there’s a risk of losing that personal artistic interpretation. Creating and expressing your own creative vision is inherently fulfilling, unlike what AI can easily parse, structure and generate. It’s something original and deeply personal, built through effort, feelings, and rationalizations. It’s not just about producing something satisfying in the moment; it’s about creating something out of your own taste that lasts, something that still feels meaningful when you’ve decided to put your fingers away from the keyboard (or pen from the paper? Yeah, don’t underestimate the mighty OG sword). Perhaps the beauty that came out of the struggle.

Given that, the consequence I see is: heavily AI-reliant writers don’t fully know or appreciate the message they’ve put out. The artist’s connection to the work is less attached, less powerful. It is less directly crafted. It is less read.

Upon deeper reflection, really placing myself in those writers’ shoes (or pen?)… there’s this hollow feeling that creeps in and extends into all sorts of directions… a substance that isn’t fully formed?… a backbone that feels incomplete?… a life half-lived?

Being an artist, whatever niche or form it may be, it’s your job to stir something inside you, and it’s your role to reconnect people to what you have seen and experienced —something heartfelt or thrilling or freeing. And when you convey it in an excellent way that people can remember, then you’re successful. You’ve really put it into existence; it now stirs and travels across minds. To achieve this, you need to fully immerse yourself in your art and build a unique relationship with it.

When the conversation is about AI, I always tell people that it’s way better to have AI than not to have it in this world. Simply because AI incredibly pushes evolution and innovation. Its efficiency and accuracy in providing information are splendid. Yet, on a human note, as living beings, I firmly believe that our core purpose and desire is to create. To live is to create. And when you create something that is entirely your own, something born fully from you, that’s indeed special. Pride may be hinted at, but I’m pointing at the healthy sense of joy and dignity through creation.

“The desire to create is one of the deepest yearnings of the human soul.”

— Dieter F. Uchtdorf

Cool, rad and legit writers told me, “Create more than you consume and create something that both you and your audience would go back to and read again and again.”

Awesome writing tip. So there, hearing it and putting it into my heart, I started courting my sentences (in such a way that I kind of lowkey compete with AI. HAHA. You fool).

But later, I found out that these legit writers also use AI. They embrace an AI-assisted workflow. They are already pro at writing, but they still adapt to AI. Am I shocked? No. Appreciating that, I’d say they know how the game really works. It’s both a matter of scaling their business and of polishing their writing techniques. They benefited from AI through its reliably fast and valid answers; in return, it essentially broadened their way of thinking and strategizing in both their business and writing.

Well, I’d say they thoughtfully apply AI to their creative work, wherein their personal artistic imprint is still louder than what the AI has contributed to it. That’s how it’s meant to be, always.

To be clear, this applies not only to writing (or business) but to every artistic form and intellectual work there is. I recently watched JRE #2479 with guests Bob Lazar & Luigi Vendittelli (I’m late to the party on this episode, though). To give some context, Bob is an engineer and a physicist, and Luigi is a film director and producer. Essentially, Luigi created a film entitled S4: The Bob Lazar Story. It revolves around Bob’s pursuit of science, from building jet engines as a teen to working as a physicist at Los Alamos National Labs, where he worked at a classified site near Area 51 known as S4, and used Element 115 to reverse-engineer extraterrestrial technology. Yeah, Bob the physicist fuckin’ rips.

So, Joe asked, “What was the technology that you guys used to recreate S4 in the film?”

Luigi stated, “The film was made with about 10% AI and 90% handmade CGI (Blender Software)”.

Boom! See! That’s an artist! And I trust what Luigi has said. If in doubt, check it (it is in the early minutes of the show; click the embedded link above).

Now, how do you think Bob reacted to the film when it was first shown to him?

Slightly reworded just as the dialogue above, but still his voice: “I was mind-blown. I felt Luigi downloaded the film from my brain. I felt like I was time-traveling back in the late ‘80s. It sent chills up my arms, and nostalgic tears welled in my eyes.”

Yeah, Luigi, the director/producer, was indeed rippingly successful too.

Bob Lazar’s UFO sketch

So I side-tripped to UFOs. Anyway, what we can appreciate about the artwork (film) is that we don’t need to rely on AI in a heavy or strict sense. Well, humans got pretty far without it, generation after generation. But we adapt to it as it solves certain problems at a scale we can’t match on our own. Machines and AIs are developed and configured to become adept at speed, precision and perplexity.

Another relevant point to appreciate is that there are explicit human intentions and reasons for the existence of such advanced technologies today. Maybe when those inventors felt like they were having a hard time communicating, it was a challenge for them to stand in a line where the majority couldn’t relate. Or maybe they’re just having a bad day with people, so they decided to invent something out of that problem. Or just out of necessity.

And, life is too short to become rigid.

The world itself expresses its own kind of life; it’s alive, it’s shaped by its own composition and the interplay of everything within it, both the living and non-living. Earth isn’t just a rigid, imperfect sphere; it spins, it revolves, it has its own world. So, as a resident, why would you consider being rigid on a planet that is constantly shifting? Isn’t that a sign of universal disrespect?

(Do I need to add this? I don’t know. I got a friend who is. But sorry, flat-earthers. Sorry.)

Well, anyway, Earth absorbs all our weirdness. The least we can do is to move. Best we can? Create art and save the planet. To live is to create, remember?

You know what else is weird or maybe tricky? For the sake of the argument, I didn’t use AI in writing this. That said, it is essential to develop the skills to write first. How do you do that? Live, imagine, read, speak, explore and actually write it down — compose your own sentences without AI, but with lessons and felt experiences (subtle pun or rhetoric intended. Y’know, the em dash. I don’t know what to call this.)

Afresh, willingly developing your writing skills first, before jumping into anything else, makes an exception. By doing this, you’re serving your artistic spirit as a writer; you prioritize the art and life of being and becoming naturally expressive. This is an elevated act for an artist.

Become the kind of artist or writer who has the discipline to keep that distinction in check.

Before we forget this, let me say: how about also showing your work to others, too? The traditional way. Ask them to critique it for improvements. This has always been ethically accepted with settled agreements. You know, there’s this thing called light ghostwriting. That came first before AI.

Okay, again, for the sake of the trick and argument, Nah, I use Grammarly in here. It automatically offered; I didn’t dismiss it (dismissed some, actually); I accepted.

But what did I really do here? Curious? I’d say 10% AI, 90% human brainwork.

If you will, come on, please give me a chance at writing and expressing. The ideas and words primarily came from my own thinking. I’ve read books, watched movies, listened to podcasts, interacted with people, interacted with my dog and birds and stray cats, experienced hardships and written journal entries nonstop. Damn. Forget that. I respectfully decline your guts.

Setting jokes aside. Really, 10:90 is an excellent proportion, a good writing bar to set. Or are you already into that? Nonetheless, let’s flow with the world’s trajectory and bend without breaking.

I got nothing to say anymore. I’m tired of explaining, too. Just re-read the paragraph before this.

I write things like this :)
And you’re invited to either:

Subscribe now

Leave a comment

Share

The guy’s shifty, even with that goofy surface. He averted disaster by turning his whole body 180, twisting his right wrist, and catching the arrow mid-air. That stunt was impressively fast and accurate. Is this really the same person as before? The fat drunk? The one who starts random nonsense to stir up random beef, all while boozing, yet still eyeing the throne?

Idea: People fight over a throne. A drunkard stands out. The person who sits on the throne becomes a member of a notorious crew?

ii.

Why does it seem like little genuine compliments are so rare these days? Is it because our attention is fragmented, or have we settled into staying neutral? Maybe our deeper awareness created and demanded explicit reasons? I think it hurts the world and wastes your potential when a day passes without you even smiling or genuinely greeting at least a single person. Come on, just a little, at least one.

Idea: Everyone’s playing it safe.

iii.

Everybody’s suffering, you and I included. So have fun anyway.
Already dead? I was. I’ve been dead before because frustration killed me.
But realizations kicked in, and so did the humor.
I guess I’m back where I belong, and I’ve been away too long.

Idea: Everybody’s Sufferin’. Honor is all we know album.

That’s Rancid.
Less suffering when you subscribe :)

Subscribe now

iv.

I’m blessed, though I’m stressed
Not dense, just quietly tense
Starship drifting in outer space
Here I am, carrying a flicker of grace

Around the moon
Not landing upon
Myself against the viewport
As the eclipse set on

The ship slows. The moon goes into silhouette.
Stoked. Gasped. Steady. Ciggarette?
Yeah, aliens all gone.
Astronaut footprints, none.

Idea: Fake moon landing and Artemis II. And what if it’s my first time going to space?

v.

Chatting over a cross joint with your crush levels everything out socially. I’m not trying to impress. She’s not being the first to guess. Both not sounding mysterious. We’re just cool and collected. It feels easy. And it’s always a good date idea, especially for a first date.

Idea: Pineapple Express: The Trifecta, Suburban California.

vi.

I’m back alive.

I went out, drank too much and stumbled home.
The road back? Forgotten.
I don’t know which path I took. Just sure that I’m 60 miles away.
I felt like I teleported. Being drunk makes everything feel possible, though.

I woke up to the aftermath.
My cold room was thick with the smell of my own mistakes.
Hangover hitting.
And now reality is getting louder, stinging.

That yesternight version of me? Done.
No more reckless lapses. Move on, punk.
Force discipline. No room for lousy moods.
Drink water. Hit the shower. Clean your room.

Thank God, I’m back home and alive.

Idea: Some day in 2022. Early journal writing style.

Drinking too much gives you the power to teleport.
If you’ve ever teleported home, too, tell me.

Leave a comment

Share

Question out of nowhere: What does reaching climax mean to you?

“Eargasm”. That’s how it registers to someone when reaching a climax.

“Almost extremely sensitive?” That’s another, more precise way to put it.

“Every nerve lit up.” Another.

“Absolute Cinema”. And that’s yet another way it registers.

So different definitions, different mental postures, different expressions. There’s something I enjoy about asking people a question with no agenda. Yet I also find it interesting how a simple question can start wholesome and innocent, but as people explore it a little further, it gradually turns into something sexually undertoned, or maybe subtly suggestive.

It’s funny because I started asking out of innocence and honesty, and now I’m flirting? HAHA.

But really, I wonder if that question says more about the words, or about us.

Subscribe now

Subscribe for free if you’re into that :)

Fragments Of Others That Became Part Of My Thinking

• Life isn’t a race.

• I’m building wealth for my nieces and nephews, not for myself.

• Maybe nothing good is happening in my life because I’m the good thing happening in everyone else’s.

• Does blue smell better than the number 12?

• Which would you choose: becoming a member of the Freemasons or joining a powerful underground hacker collective?

• Dreams or practicality? Is it a false fight?

• Yesterday’s notorious assassin is today’s apple martini–drinking overlord.

• Die like a punk song outro. Vibrant, then lifeless, but still vibrant.

• Mug, mug, mug.

Bluebird.

She wasn’t just a bluebird; she was my buddy, my good morning friend.

For four years, we greeted each other every single day. It sounds like a long time, but it never really felt like it.

Every sunless morning, I’d sit on the balcony with my cup of oolong tea (sometimes matcha, sometimes ceylon, sometimes turmeric, sometimes chamomile), and there she was, tweeting. I’d always look over, smile, and nod back, quietly admiring her.

Then one day, she didn’t come… And she never did again.

Another four years have passed since that morning. Here I am, back on the balcony, just me and the memory of her. My friend is gone. I miss her blue feathers and her gentle chirps.

The coldest wind blows, one I haven’t felt in a while, and it makes me think…

I would trade every cup of tea I’ve had since, even the best ones, to sit on the balcony and hear her tweets and chirps again, even just once.

My 5-year-old nephew.

Nephew: How big is your heart?
Me: Isn’t it about the size of our fist?
Nephew: How old is our galaxy?
Me: Uh… billions. 11 billion?
Nephew: 13 billion years old.
Me: Close enough.
Nephew: It is.

(Nephew paused, thinking)

Nephew: You’re smart.
Me: Not as smart as you.
Nephew: You’re my coolest uncle.
Me: Oh yeah? Why?
Nephew: Because… I feel my other uncles and aunties are dumb.

Willow State

Dear Girlfriend,

There are infinite things I could thank you for.

From turning my life from a painful spinal condition into a delightful chaos, to caring about my bulging disc, and somehow answering it through my bulging dick.

I’m grateful to you for being my co-trendsetter, my co-conspirator, my ally in creating new patterns in a world that naturally drifts toward entropy.

Love,
[Write Your Name]

Is knowledge a comfort to me?

Philosophy refines perception, it sharpens nuance and trains discernment.

One day, a Philosopher asked me, What is knowledge?

I answered on the spot, Just what you know, right?

And so, she, the philosopher, went on and on… (yeah, she babbled, at least, that’s how it sounded to me).

Not that simple, my friend. Not in philosophy.
See that knowledge is a state. It’s your mind lining up with reality.
There’s knowledge by acquaintance; it’s about direct experience.
And propositional knowledge, which essentially involves facts.
Facts are statements that can be true or false, and we humans tend to favor facts.

So I asked, why?

Facts are easy to pass around. Take this, for example:

Simplicity is elegance. But what are you going to do if it isn’t the truth? Is it still sophistication? It may conceal something. Maybe add some precision? Knowledge?

I processed, so you’re asking me?

She shook her head. No. I’m showing you how easily it can be passed around. They can be stated, tested, and judged true or false. That’s how we make sense of reality together.

I processed even longer. Uhhhhh. So, when you’re knowledgeable, you’re sensible? Uhhh. Wait…. Can knowledge be falsified?

Yes, my friend. But once it’s falsified or false, it’s no longer knowledge. In philosophy, knowledge usually means true propositions. Only statements that are actually true connect your mind to reality. So, when you reasoned with it and discovered it is false, then it is true. That’s knowledge, it’s justified truth.

I processed even longer than the last. Uhhhhhh… ssshhhiii… Knowledge isn’t sinkin’ well. It’s like my girlfriend’s text, sometimes true, mostly false, always confusing…What’s the other kind?

Knowledge by acquaintance. Experience, on the other hand, doesn’t work like facts. It can’t be handed over easily. You can describe it, but it only grows through time and attention.

I thought about it for a second, nodded slowly, and said, Yes! Alright! Am I a philosopher yet?

She smiled.

You stayed longer than most.
If you’ve got a thought, I’d like to hear it.
Thaks for reading!

Leave a comment

Share

If yes, well, you’re likely to adore heavy use of guitar effects like distortion, reverb, and feedback, creating a dense “wall of sound” texture. You may be the kind of audience that is often inclined toward vocals that are subtly soft, obscured, and buried in the mix, adding to the immersive atmosphere. You probably also enjoy going to live venues, watching musicians perform and messing around with their gear in real time. Overall, you’re into music that doesn’t just play to you, but pulls you in and surrounds you.

Got any songs in mind from that vibe so far?

Well, I’m talking about shoegaze. Some might say shoegaze is a branch that belongs to alternative rock, while others consider it a sub-genre of indie rock; either way, its classification often depends upon whatever your gut is vibing with that day. Yeah, we’re ending the debate right away. Personal interpretation wins.

Shoegaze or Shoewave (if you prefer) emerged in the UK and Ireland in the late ‘80s and kind of faded out by the early ‘90s. But it never really died. Decades later, it made a comeback, re-emerging through internet-driven rediscovery, as new bands and audiences pick up the sound, reviving it and making it viral.

Coincidence… or did the algorithm already know something we didn’t? kinda sus.

These days, older tracks can suddenly blow up out of nowhere, as if they’re being pulled back into relevance by the internet itself. It’s pretty wild. Any genre, any era, any song could randomly take off again in the future.

Anyway, personally and broadly, modern shoegaze/shoewave is today’s revival and evolution of the original shoegaze sound from the late ’80s and early ’90s.

Dream pop? Ain’t having much of that. But I could say enough that they’re not really the same thing. Shoewave is distinct because the vocals are low in the mix, often hard to make out, and treated more like another instrument than the focus. Dense, layered guitar textures drive the sound. Dream pop, on the other hand, keeps the vocals clearer and more upfront. In shoegaze, lyrics are often blurred or subtly buried; it’s more about mood and emotional texture than lyrical clarity.

Subscribe for free and stay in the haze :)

Subscribe now

So, let’s define shoegaze by diving into a few tracks and letting the sound do the talking:

So are you the kind of person who’d add shoegaze to your playlist on purpose…Or are you the kind of person of that ilk who’s already been listening to it without even realizing it?

Haha. Either way, the name’s rad, the wall of sound’s radder. Original or modern, let’s lean in and listen more.

Thanks for exploring :)

Leave a comment

Share

Our streak was on fire. Our chemistry was intense, the sex was passionate and great, but reality has teeth, and it bit down hard. The timing and circumstances were such that the thieves just weren’t on our side. We dared each other, pushed edges, laughed too loud and touched in ways that made the world outside fade away. But nothing lasts.

Will I ever find anyone again who won’t use time anymore? A soul who doesn’t let time dictate what we could be? Someone fully here, holding nothing back? It’s rare. It’s not easy. And I’m a badfish too.

I’m losing hold of reality. I ain’t romanticizing the planet. I keep voicing my frustrations, even though I know they are brushed aside. My inner critic has grown too loud, too merciless, drowning out the better parts of me. So I stop questioning and move forward, strange and unsteady as that feels. Is this growing up? It ain’t feel like a bold choice or a dramatic leap. It’s merely the flow of life pushing, following a feeling in my heart, surrendering to it.

Suppose I could get to sleep at all. Rest my mind from the push and pull, find a safe harbor for my inner contradictions. All because I know, I still care. Or maybe, I’m just blacking out in the middle of a lie.

I think this is the unglamorous edge of growing up. Yet somehow, I still found myself wanting to take you out for sushi, as if nothing else had changed

Subscribe now

Subscribe for free if you’ve felt that.

Take Fool Responsibility For Your Own Existence.

Fearing looking like a fool? Risk it. Stagnation is far worse. Become the fool who moves, not the dignified soul who stays safe. The real fool sits idly by, carrying a pain he can’t name. There’s a dull, unidentifiable ache. A life half-lived with no clear reason why.

It is indeed a pain. But this pain doesn’t break you loudly. It lingers, quiet and constant, until it becomes part of who you are. You wake up one day, nothing seems wrong, and yet, it feels empty.

The moving fool? He’s planning a big surprise. Taking bold, imperfect, deliberate acts that pull him into unknown spaces, while the world hesitates.

It’s easy to imagine people, but I’ve lived to see both sides of the coin. Some protect their image. Some build a life. One fears embarrassment; the other lives punk and fully. The level of effort and stokeness differs. Simply, the fool who’s in motion is aware that the biggest poison in humans is regret.

Don’t Know What Even Love Is.

Come here, my dog, let’s hug it out.
Send me love, I wanna know about.
Wake up, get up.
Don’t just wag your white tail.
Make noise, bark out.
I got cheese burger, ain’t you smellin’ it?
Come on, let’s mangle it.
Ain’t this love?

Grinding on a Wednesday.

There were plenty of times before when I considered journaling, but I didn’t follow through enough. Now, I often catch myself wondering why I didn’t commit to writing sooner. What if I had realized earlier that it would become something I truly enjoy? What if I had taken a writing course instead of spending so much time in tech?

I’m viewing the past with the clarity I’ve only now gained. Back then, I had no way of knowing that journaling would become personally meaningful. I found it through experience, not foresight. And interestingly, time in tech may have influenced how I think, analyze, structure, and observe, which now reflects in my writing.

What is Love?

This question never ends. And its answer always changes. Love is one of those things that’s easy to sense in your chest, but hard to define.

In essence, love is a deep attachment and care for someone. Something beyond just attraction or conveniences. It’s when their happiness matters to you. You choose their feelings over yours, not just when it’s easy, but even when it’s not. When it’s not easy, you realize it isn’t a fleeting emotion; it’s a deep commitment.

Love isn’t always constant warmth. It dares you to have patience in conflict, understanding in frustration, and presence even when words fail. It’s a challenge valuing someone else’s being as much as, or sometimes more than, your own.

Id-driven.

When hit with a bad vibe, the automatic choice is to go into fight mode. Suddenly, you’re delivering comeback lines like you’ve been training your whole life for this exact moment. Tone gets colder than your ex’s replies, voices get louder, and now it’s less a conversation and more of the ending of a verbal WWE promo.

Next thing you know, everyone’s said things they definitely won’t apologize for properly, and the room feels like a microwave with unresolved tension.

All because someone had a tone.

Leave a comment

Share

In futurism, tech discourse, and even human affairs, the singularity is often defined as the cusp of rapid acceleration, where the pace of change becomes unpredictable relative to the past. The rate of change keeps climbing until old patterns fail and the past can no longer guide us. When the world moves faster than our beliefs can keep up, clinging to certainty turns conviction into a liability.

In a stable world, conviction is power; in a rapidly changing one, updating is power.

Today, we face historically high levels of uncertainty, driven by overlapping economic, technological, environmental, and behavioral crises. This constant flux stems from information gaps, complex systems, and unpredictable events, revealing that our standard predictions can’t keep up

Subscribe now

How, then, do we navigate a world defined by singularity?

Probabilistic thinking offers a way. Practicing this can repeatedly dissolve and reconstitute the mind, releasing fixed expectations and leaning into change as the ever-present force. And perhaps, in doing so, we become a little less dangerously insecure.

As you age, making friends gets different. The rules of friendship have shifted from proximity to intentionality. They’re just not in the same neighborhood or village anymore. You don’t make friends by accident; more often, you filter and choose them now, regardless of the place.

You could look at it as an advantage. You’re not trying to impress everyone, you’re trying to find your people. At the same time, you’re not too late to make friends; you’re just choosing more carefully.

As we age, we have less time, clearer boundaries, and less patience for shallow connections. But deep down, the desire for true friendship remains.

Late-Night Logic.

Him: You crossed my mind today… and stayed longer than expected.
Her: 😏

Him: I lowkey miss your presence.
Her: Lowkey?

Him: Yeah… you’ve been on my mind. I’m not clear on how I feel about that yet.
Her: That’s just lowkey lust.

Poster Child’s Orbit.

Rick and Morty in a cardboard rocket, dodging traffic cones.
Box Car Racer blasting on the stereo with neon clones.
Spritzed mango in my hookah, smokin’ like a chong.
Wait, that’s an OG hybrid kush, dawg, carry me home.

It’s like… I wanna be a Warhol, staring at her, naked.
And if you ask me for the vibe, it’s a surreal-like love, pixelated.
Now, your beagle dog is on the floor, while you’re fucking that sexy whore.
She’s arm grippin’, scratchin’ and sayin’ more!

Now, someone’s knockin’ on the door;
funky, quirky shadows dance across the floor;
It looks like a dinosaur.
Everything’s absurd… reality implores.

Subscribe now

Blake.

A dog’s loyalty is never absolute. Part of it belongs to its master; part to its own instincts and survival. Even the most obedient pets sometimes resist. They push back to roam, to play, to follow the smell, whims and impulses. Their nature cannot be fully denied. Even when held in your spacious backyard, they cherish freedom.

Chains are for machines.

Humans, by contrast, are often asked to offer unwavering loyalty to companies, institutions, or roles. But unquestioning loyalty is brittle. It exhausts and eventually fractures.

What endures instead is fidelity. Service chosen, not coerced. True dedication comes not from obligation alone, but from intention.

To serve genuinely is to align conscience with duty, to embrace responsibility with understanding, not submission. It is to love what you do and honor it fully. That is human. Not a machine.

Come on over and do the twist.

Working out, challenging your body, is one of the most effective ways to combat any mental degeneration. It is always an absolutely good idea to exercise whenever work, studies, worries, slackness, excitement, or novelty crowd your mind. Moving with intention sets your rhythm, clears mental clutter, and acts as a powerful, accessible therapy for both body and mind.

Learn an instrument.

Learn how to play at least one musical instrument. It just gives you a different kind of rhythm. Even if your feet don’t move gracefully, your fingers and ears can carry the music. It’s kind of a secret power.

Ritual.

My ritual is to listen to a podcast while working out. Body moves, mind grows. It’s like multitasking for self-care. Fitness for your muscles, ideas for your brain.

But what if those days aren’t wasted at all?

What if unproductive days can actually become quiet preparation?

Think of those idle days or lethargic moments (admit it) as times when your mind rests, digests reality and connects the dots beneath the surface. Perhaps, these pauses may precede breakthroughs; a space where creativity brews, where clarity forms and priorities settle. Productivity’s shadow? Reminding us that productivity isn’t only about action and output; it’s also reflection, recuperation and recalibration.

So when a day seems unproductive, perhaps it’s quietly doing the inner work, readying you for better days ahead. Don’t rush to fill it with action or punish yourself for idleness. Unproductive days aren’t empty; they’re fertile.

Subscribe now

We’re still dealing with Python’s String Methods, and it actually matters.

Why tho?

It matters because text is everywhere in programming.

It’s in logs, user inputs, config files, APIs, security alerts, filenames, emails, and more.

And if you can’t wrestle and manipulate strings efficiently, you can’t control or analyze data properly.

Here’s part 1 to appreciate the foundation:

So now, we pick up where we left off.

10_strings

In programming, string methods are built-in functions or operations you can perform on strings to manipulate, analyze or transform them.

String methods are part of the string object in most programming languages.

Here’s a logical breakdown:

1. Basic Case Conversion

2. Removing and Cleaning Text

3. Searching and Finding Text

4. Splitting and Joining Strings

5. Replacing and Modifying text

6. Checking String Content (Validation Methods)

7. Alignment and Formatting

8. Advanced SPlitting and Partitioning

9. Formatting Strings

10. Encoding and Tabs

We’ve finished the first three: Basic Case Conversion, Removing and Cleaning Text, and Searching and Finding Text.

We’ll now shift our focus to the next set of string operations.

4. Splitting and Joining Strings

Convert between strings and lists

Methods:

• split()

• rsplit()

• splitlines()

• join()

split()

This string method splits a string into a list using a separator.

Syntax:

• string.split(separator, maxsplit)

  • separator - what to split on (default is whitespace).

  • maxsplit - maximum number of splits (optional).

Basic:

text = "I Wanna Be Adored"

result = text.split()
print(result)

The default separator when using split() is whitespace.

Split by a specific character:

text = "turnstile,social distortion,dead to me"

print(text.split(","))

On a side note, try listening to Turnstile’s rendition of “I Wanna Be Adored.”

Using maxsplit:

text = "one two three four"

print(text.split(" ", 2))

This only splits twice.

Again: string.split(separator, maxsplit)

• separator - what to split on (default is whitespace).

• maxsplit - maximum number of splits (optional).

Real-World Example (Log Parsing):

log = "ERROR: Failed login from 192.168.1.10"

parts = log.split(" ")
print(parts)

Now you can extract the IP address:

log = "ERROR: Failed login from 192.168.1.10"

parts = log.split(" ")
print(parts)

ip = parts[-1]
print(ip)

Splitting File Extensions:

filename = "report.pdf"

name, extension = filename.split(".")
print(name)
print(extension)

Note: This works only if there’s one dot. For safer extraction, rsplit(".", 1) is better.

rsplit()

rsplit() splits a s string starting from the right side of the string.

It works like split(), but the splitting begins from the end.

Syntax:

• string.rsplit(separator, maxsplit)

  • separator - character/string to split on (optional)

  • maxsplit - maximum number of splits (optional)

Return value:

• Returns a list of substrings

• Splits from the right side

Basic Example:

text = "baki,doppo,retsu"

print(text.rsplit(","))

With no maxsplit, it behaves like split()

With maxsplit:

text = "one two three four"

print(text.rsplit(" ", 1))

Only one split, starting from the right.

Difference between split() and rsplit()

The obvious difference is the direction.

split() goes from left to right.

rsplit() goes from right to left.

Example:

text = "one two three four"

print(text.split(" ", 1))
print(text.rsplit(" ", 1))

Real Example (File Extension):

filename = "backup.database.sql"

name, extension = filename.rsplit(".", 1)

print(name)
print(extension)

This is safer than split() because filenames may contain multiple dots.

Real Example (Log Parsing):

log = "INFO User login from 192.168.1.15"

parts = log.rsplit(" ", 1)
print(parts)

Useful for extracting the last field (IP address).

Essential Rule:

• Use split() when parsing from the start.

• Use rsplit() when extracting something from the end.

splitlines()

This is used to split a string into a list of lines.

It separates the text wherever there is a line break.

Syntax:

• string.splitlines(keepends)

  • keepends - optional

    • False - removes newline characters (default)

    • True - keeps newline characters

Return Value:

• Returns a list of lines

Example:

text = "In\nBetween\nDays"

print(text.splitlines())

The \n newline characters are used to split the string.

With keepends=True:

text = "Hello\nThere\nWorld"

print(text.splitlines(True))

The newline characters are kept.

With Multiline Text:

text = """Error: login failed
Warning: password attempt
Info: user logged out"""

print(text.splitlines())

Real-world Example (Log Processing):

logs = "ERROR: Login failed\nINFO: User logged in\nWARNING: Retry attempt"

lines = logs.splitlines()

for line in lines:
    print(line)

This is useful when analyzing logs or reading multiline text.

Explanation:

• Splitting the strings into lines

  • As we already know, the splitlines() method splits the string at every newline (\n) and returns a list of lines.

  • So lines becomes:

    [
    "ERROR: Login failed",
    "INFO: User logged in",
    "WARNING: Retry attempt"
    ]

  • Each Log entry is now a separate element in the list.

• Looping through each line

  for line in lines:

  • This loops through the list one element at a time.

• Iteration order:

  1. "ERROR: Login failed"

  2. "INFO: User logged in"

  3. "WARNING: Retry attempt"

• During each loop, the variable line temporarily holds one of those values

Difference between split(), rsplit() and splitlines()

splitlines() splits on many newline types (\n, \r, \r\n)

split("\n") goes from left to right. And it splits only on \n

Now…

split() - split by separator

rsplit() - split from right

splitlines() - split by line breaks

5. Replacing and Modifying Text (Beginner)

Modify string content

• replace()

• translate()

• maketrans()

• removeprefix()

• removesuffix()

replace()

The replace() method is used to replace part of a string with another string.

Syntax:

• string.replace(old, new, count)

  • old - the text you want to replace

  • new - the text that will replace it

  • count (optional) - how many occurrences to replace

Basic Example:

text = "me gusta punk"
result = text.replace("punk", "reggae")

print(result)

Replace Multiple Occurrences:

text = "punk punk punk"
result = text.replace("punk", "reggae")

print(result)

Replace Only a Specific Number:

text = "apple apple apple"
result = text.replace("apple", "orange", 2)

print(result)

Practical Example (Cleaning Text):

message = "Hello_user123"
clean = message.replace("_", " ")

print(clean)

Strings in Python are immutable, meaning replace() does not change the original string; it returns a new string

text = "Hello world"
text.replace("world", "Python")

print(text)  # still unchanged

NOTE:

replace() = find text; swap it with something else.

maketrans() and translate()

maketrans() is used to create a translation table, which you then use with translate(). It builds the rules.

translate() method is used to replace or remove characters in a string using a translation table. It applies the rules.

Syntax:

• str.maketrans(x, y, z)

  • x - characters to replace

  • y - characters to replace them with

  • z - character to remove

• string.translate(table)

  • table - a translation table created using str.maketrans()

Example:

text = "hey! ho!"
table = str.maketrans("h","y")
result = text.translate(table)

print(result)

Replacing Multiple Characters:

text = "let's GO"
table = str.maketrans("let","LET")
result = text.translate(table)

print(result)

Remove Characters:

text = "let's GO"
table = str.maketrans("", "", "let")
result = text.translate(table)

print(result)

Explanation:

• Original string:

  text = "let's GO"

• Creating a translation table

  table = str.maketrans("", "", "let")

  • As you may already know, str.maketrans() creates a translation table that translate() use.

  • It has three parameters: str.maketrans(x, y, z)

    • x - characters to replace

    • y - characters to replace them with

    • z - characters to delete

  • What we had:

    x = ""
    y = ""
    z = "let"

  • It says: Delete the characters “l”, “e”, and “t” from the string.

• Applying the translation

  result = text.translate(table)

  • translate() suses the table to modify the string

• Print result

  's GO

Practical Example (Cleaning Text):

text = "Hello!!! How are you???"

table = str.maketrans("", "", "!?")

clean = text.translate(table)

print(clean)

Practical Example (Sanitizing Input):

text = "User@123!!!"

table = str.maketrans("", "", "!@")

clean = text.translate(table)

print(clean)

Passing a Dictionary:

text = "hello"

table = str.maketrans({
    "h": "H",
    "e": "3",
    "o": "0"
})

print(text.translate(table))

Difference Between replace() and translate()

These methods are fast ways to remove or replace characters in a string.

replace() is for replacing words or substrings (swap words).

translate() is for efficiently replacing multiple characters (swapping characters using a map).

text.replace("cat", "dog")     # word replacement
text.translate(table)          # character mapping

removeprefix()

This is used to remove a specific prefix from the beginning of a string, only if it exists.

Syntax:

• string.removeprefix(prefix)

  • prefix - the starting text you want to remove

Example:

text = "subzero"

result = text.removeprefix("sub")

print(result)

If Prefix doesn’t match:

text = "zero"

result = text.removeprefix("sub")

print(result)

Nothing changes if the prefix is not found.

Practical Example (Logs / Data Cleaning):

log = "ERROR: User unauthorized - 401"

clean = log.removeprefix("ERROR: ")

print(clean)

Common Use Case (URLs)

url = "https://example.com"

clean = url.removeprefix("https://")

print(clean)

NOTE:

It removes only from the start, not in the middle or at the end.

It removes exact matches only.

Also, strings are immutable. Hence, removeprefix() returns a new string.

removesuffix()

removesuffix() is used to remove a specific suffix from the end of a string, only if it exists.

Syntax:

• string.removesuffix(suffix)

  • suffix - the ending text you want to remove

Example:

text = "filename.txt"

result = text.removesuffix(".txt")

print(result)

If the suffix doesn’t match:

text = "filename.txt"

result = text.removesuffix(".jpg")

print(result)

No change if the suffix isn’t found.

Cleaning Data:

url = "example.com/"

clean = url.removesuffix("/")

print(clean)

Common Use (File Extensions)

file = "report.pdf"

name = file.removesuffix(".pdf")

print(name)

NOTE:

It works only at the end of the string.

It requires an exact match.

It returns a new string (original is unchanged)

6. Checking String Content (Validation Methods)

These return True or False

• isalnum()

• isalpha()

• iasascii()

• isdecimal()

• isdigit()

• isnumeric()

• isidentifier()

• islower()

• isupper()

• istitle()

• isspace()

• isprintable()

isalnum()

isalnum() checks if all characters in a string are alphanumeric.

So, what counts as alphanumeric?

• Letters: a-z, A-Z

• Numbers: 0-9

• No spaces, symbols, or punctation allowed.

Syntax:

• string.isalnum()

Return Values:

• Returns True if all characters are letters or numbers.

• Returns False if there’s even one space, symbol, or if the string is empty.

Example:

print("abc123".isalnum())     # True
print("Hello".isalnum())      # True
print("12345".isalnum())      # True

print("abc 123".isalnum())    # False (space)
print("hello!".isalnum())     # False (!)
print("".isalnum())           # False (empty string)

Useful for input validation, like checking usernames:

username = "user123"

if username.isalnum():
    print("Valid username")
else:
    print("Invalid username")

isalpha()

It checks if all characters in a string are alphabetic, meaning letters only.

What counts?

• Only letters allowed (a–z, A–Z, and even Unicode letters like ñ, é)

• No numbers, spaces, or symbols

• An empty string returns False.

Syntax:

• string.isalpha()

print("hello".isalpha())     # True
print("Python".isalpha())    # True

print("hello123".isalpha())  # False (contains numbers)
print("hello world".isalpha()) # False (space)
print("hello!".isalpha())    # False (!)
print("".isalpha())          # False (empty string)

Use case:

name = "Fat Mike"

if name.isalpha():
    print("Valid name")
else:
    print("Invalid name")

There’s a space

isascii()

It checks whether all characters in a string are ASCII.

ASCII characters include:

• Letters: A–Z, a–z

• Numbers: 0–9

• Symbols: ! @ # $ %, etc.

• Control characters (like newline \n)

Return Values:

• Returns True if all characters are in the ASCII (0-127 range.

• Returns False if any non-ASCII character is present

• Empty string returns True

Syntax:

• string.isascii()

print("hello".isascii())        # True
print("123".isascii())          # True
print("hello123!".isascii())    # True

print("ñ".isascii())            # False
print("你好".isascii())         # False
print("helloñ".isascii())       # False

Quick case:

text = input("Enter text: ")

if text.isascii():
    print("Standard ASCII text")
else:
    print("Contains special/unicode characters")

isdecimal()

isdecimal() checks if all characters in a string are decimal digits. This is stricter than just “numners”. It includes only characters that can be used to form base-10 numbers.

Syntax:

• string.isdecimal()

Example:

print("12345".isdecimal())      # True
print("٠١٢٣".isdecimal())       # True (Arabic-Indic digits)
print("123.45".isdecimal())     # False (decimal point is not a digit)
print("123a".isdecimal())       # False (letter)
print("".isdecimal())           # False (empty string)

NOTE:

• Only decimal digits count (0-9 and other Unicode decimal digits)

• Symbols, letters, spaces, and punctaiton return False.

• Empty string returns False

isdigit()

isdigit() is a string method that checks if all characters in a string are digits, including more than just decimal digits. It’s slightly broader than isdecimal()

Syntax:

• string.isdigit()

Example:

print("12345".isdigit())        # True (regular digits)
print("²³".isdigit())            # True (superscript digits)
print("123.45".isdigit())        # False (decimal point is not a digit)
print("123a".isdigit())          # False (contains letter)
print("".isdigit())              # False (empty string)

NOTES:

• Include digits like 0-9 and Unicode digits (superscripts, subscripts, etc.)

• Returns False if any non-digit character is present (letters, punctuation, spaces)

• Empty string returns False.

isnumeric()

isnumeric() is a Python string method that checks if all characters in a string are numeric, which is the broadest numeric check among the is*() methods.

It includes decimal digits, digits from other number systems, and numeric characters like fractions, subscripts, superscripts, and Roman numerals.

Syntax:

• string.isnumeric()

Examples:

print("12345".isnumeric())      # True (regular digits)
print("²³".isnumeric())          # True (superscript digits)
print("⅕".isnumeric())           # True (fraction)
print("123.45".isnumeric())      # False (decimal point is not numeric)
print("123a".isnumeric())        # False (contains letter)
print("".isnumeric())            # False (empty string)

NOTE:

• Covers all numeric characters in Unicode (decimal, superscripts, fractions, Roman numerals, etc.)

• Retruns False if any non-numeric character ir psresent

• Empty string returns False

isidentifier()

It checks if a string is a valid Python identifier (e.g., a valid vairable, function, or class name).

Syntax:

• string.isidentifier()

What xmakesampl a valid identifier?

• Contains:

  • Letters(a–z, A–Z)

  • Digits (0–9)

  • Underscores (_)

• Rules:

  • Must not start with a digit

  • No spaces or special characters (@, #, -, etc.)

  • Cannot be a Python keyword (like for, if, class)

Example:

print("variable1".isidentifier())   # True
print("_name".isidentifier())       # True

print("1variable".isidentifier())   # False (starts with number)
print("my var".isidentifier())      # False (space)
print("user-name".isidentifier())   # False (- not allowed)
print("for".isidentifier())         # True (but it's a keyword!)

Important Note:

isidentifier() does NOT check for keywords, so:

import keyword

print("for".isidentifier())          # True
print(keyword.iskeyword("for"))      # True

To fully validate a variable name, use both:

import keyword

print("for".isidentifier())          # True
print(keyword.iskeyword("for"))      # True

name = "for"

if name.isidentifier() and not keyword.iskeyword(name):
    print("Valid variable name")
else:
    print("Invalid variable name")

Useful for validating:

• Variable names

• Function names

• User-defined identifiers

islower()

Checks if all cased characters in a string are lowercase

Syntax:

• string.islower()

Return Values:

• Returns True if all letters are lowercase

• Ignores numbers, symbols, and spaces

• Returns False if:

  • There is any uppercase letter

  • There are no letters at all

  • String is empty

print("hello".islower())      # True
print("hello123".islower())   # True (numbers are ignored)
print("hello!".islower())     # True (symbols are ignored)

print("Hello".islower())      # False (uppercase H)
print("HELLO".islower())      # False (all uppercase)
print("123".islower())        # False (no letters at all)
print("".islower())           # False (empty string)

Use Case:

text = "security"

if text.islower():
    print("All lowercase")

isupper()

Checks if all cased characters in a string are uppercase.

Syntax:

• string.isupper()

Return Values:

• Returns True if all letters are uppercase

• Ignores numbers, symbols, and spaces

• Returns False if:

  • There is any lowercase letter

  • There are no letters at all

  • The string is empty

print("HELLO".isupper())      # True
print("HELLO123".isupper())   # True (numbers ignored)
print("HELLO!".isupper())     # True (symbols ignored)

print("Hello".isupper())      # False (lowercase present)
print("hello".isupper())      # False (all lowercase)
print("123".isupper())        # False (no letters)
print("".isupper())           # False (empty string)

Use Case:

text = "ADMIN"

if text.isupper():
    print("All uppercase")

istitle()

Checks if a string is in title case, meaning every word starts with an uppercase letter followed by lowercase letters.

Syntax:

• string.istitle()

Return:

• Each word must start with uppercase letter followed by only lowercase letters

• Ignores numebrs, symbols, and spaces

• Returns False if:

  • Any word does not follow title case

  • The string is empty

Example:

print("Hello World".istitle())    # True
print("Python Is Fun".istitle())  # True
print("Hello world".istitle())    # False (world not capitalized)
print("HELLO WORLD".istitle())    # False (all uppercase)
print("hello world".istitle())    # False (all lowercase)
print("123 Go".istitle())         # True (numbers ignored)
print("".istitle())               # False (empty string)

Use Case:

text = "Data Science"

if text.istitle():
    print("Properly title-cased")

isspace()

It checks whether all characters in a string are whitespace.

Syntax:

• string.isspace()

What counts as whitespace:

• Space: " "

• Tab: "\t"

• Newline: "\n"

• Other Unicode whitespace characters

Return Values:

• Returns True if all characters are whitespace

• Returns False if there is any non-whitespace character or the string is empty

print("   ".isspace())       # True (spaces only)
print("\t\n".isspace())      # True (tabs and newlines)
print(" a ".isspace())       # False (contains non-whitespace)
print("".isspace())          # False (empty string)
print("hello".isspace())     # False (letters)

Use case:

text = "    "
if text.isspace():
    print("String contains only whitespace")

This one is especially useful when validating input to ignore empty or space-only strings.

isprintable()

It checks if all characters in a string are printable.

Syntax:

• string.isprintable()

What counts as printable:

• Letters: A–Z, a–z

• Numbers: 0–9

• Symbols and punctuation: ! @ # $ %

• Spaces

Non-printable characters include:

• Newlines \n

• Tabs \t

• Other control characters

Return Values:

• Returns True if all cahracters are printable ( or stirng is empty)

• Retruns False if any characeter is non-printable

Examples:

print("Hello World!".isprintable())  # True
print("12345".isprintable())         # True
print("Hello\tWorld".isprintable())  # False (tab)
print("Line1\nLine2".isprintable())  # False (newline)
print("".isprintable())              # True (empty string is considered printable)

Use Case:

text = "Hello World!"
if text.isprintable():
    print("Safe to display")
else:
    print("Contains control characters")

In This Pit

So we’ve tackled:

• Splitting and Joining Strings

• Replacing and Modifying text

• Checking String Content (Validation Methods)

But again, we didn’t just manipulate text. We made it behave. We made them work in real scenarios, turning raw strings nto structured data, clean outputs, and actionable resutlts. From parsing input to formatting for reports, every method had its moment. This isn’t theory; this is strings in action.

Part 3 ahead.

But in reality? Way messier.

Gap Analysis creaches in like a riot, tearing through links: absent rules, sloppy habits, and half-baked policies.

Bang. Cracks, Holes, and Chaos. All laid bare.

And now? Time to fix it… or continually get wrecked.

The Gap Game

An organization begins by assessing its current security posture against a desired or required standard through a Gap Analysis.

Gap Analysis focuses on identifying gaps or areas where controls, policies, or practices are missing, insufficient, or misaligned with best practices or compliance requirements. Once these gaps are identified, the next step is to determine the actions and measures needed to achieve the target security posture.

Put simply:

• Where are we now?

• Where do we want to be?

• What’s stopping us?

• What should we do to close the gap?

Sounds simple, right?

While it may sound simple, doing it is a grind. Performing the evaluation is complex and can take weeks, months, or even years, often involving multiple stakeholders, data collection, and extensive project planning.

It’s not just the technical work. It’s also about herding egos, the effort in tracking down data, and probably dodging endless planning meetings. And still, every uncovered gap is a wake-up call: fix it… or face the potential consequences.

How It Works

Define the Baseline

It’s consistently beneficial to set a baseline before diving into Gap Analysis.

What’s our starting line?

What’s our target state or benchmark to measure every move against?

Baseline may come from an established framework, standard, or regulations, such as:

• ISO/IEC 27001 - Framework for ISMS (Information Security Management Systems)

• NIST CSF (Cybersecurity Framework) - Provides a flexible framework for managing and reducing cybersecurity risk.

• PCI-DSS (Payment Card Industry Data Security Standard) - Ensures secure handling of cardholder data.

• HIPAA (Health Insurance Portability and Accountability Act) - Protects sensitive patient health information.

• SOC 2 (System and Organization Controls 2) – Focuses on security, availability, processing integrity, confidentiality, and privacy of systems.

• MITRE ATT&CK - For threat-informed gap analysis against real-world TTPs

• Custom Baselines - Tailored ot the organization’s specific requirements and risk profile.

Assess the Current State

What’s really going on right now?

What are the current performance levels, processes, or results?

This is the time to check the reality. We evaluate the organization’s existing security contorls, policies, procedures, technologies, and configurations as they are implemented today.

Gap Analysis usually hits three fronts: people, processes, and systems.

People

Evaluate IT staff’s security expertise, training, and familiarity with policies and procedures.

Who’s got the skills, the training, the policy know-how?

Who’s on point, and who’s just coasting?

Processes

Evaluate IT systems for adherence to established security standards and policies.

How well do your IT systems actually follow the rules? It is a paper policy versus reality. And sometimes, it’s a rude awakening.

Technology Systems

Identify vulnerabilities in the current IT infrastructure and benchmark them against industry best practices to mitigate risk.

Where are the cracks? Where could it blow up?

Understanding and mapping trust boundaries is critical to this assessment.

Image Source: humanrisks.com

Gap Analysis aims to break down broad security areas into detailed components.

For instance:

• Security Awareness Training can be segmented into phishing simulations, policy education and role-based exercises.

• Data Protection can be split into encryption, backup and recovert, and data loss prevention.

• Identity and Authentication can be divided into single sign-on, multi-factor authentication, and credential lifecycle management.

By examining each phase individually, potential gaps can be identified more efficiently.

Identify the Gaps

After assessing the current state, collecting and analyzing data across all locations and systems, a gap analysis report is compiled.

This report is used to:

• Compare the current state against the target state (baseline objectives) to uncover deficiencies, such as missing contorls, outdated policies, unpatched systems, or lack of training.

• Identifies the resources, time, and changes needed to close gaps.

• Provides a prioritized roadmap for implementing security improvements.

Prioritize and Remediate

Rank gaps by risk level and business impact, then develop a remediation roadmap to close them.

Visualization tools, such as color-coded tables, can highlight areas requiring immediate focus:

• Green - Close to baseline

• Yellow - Partial compliance

• Red - Requires significant work.

Ultimately, a gap analysis provides both a snapshot of the current security posture and a clear plan to achieve the desired level of protection.

Gap Analysis: Play Hard or Get Played

This is where you get real about your security posture. Gap Analysis lays out where you stand, where you need to be, what’s missing in-between and what it will take to get there. No guesswork, just facts.

Why it matters:

• Compliance - Ensures the organization meets regulatory requirements ahead of audits.

• Risk Reduction - Identifies vulnerabilities before attackers can exploit them.

• Resource Planning - Justifies security budgets by quantifying gaps and needs.

• Roadmap Building - Provides a structured path toward a mature, effective security program.

• Benchmarking - Enables tracking of security improvements over time.

At its core, it’s a reality check for your security. It’s an unfiltered look at what’s actually working versus what jsut looks good on paper. It strips away assumptions, outdated controls, and false confidence, forcing you to conforont real exposure, weak enforcment, and overlooked risk.

Expose the gaps. Patch them. Move on stronger.

Because of this, we’re now aware that a SIEM system effectively combines the functions of SIM and SEM.

The Security Information Management (SIM) component collects and organizes relevant security logs, such as Active Directory logins, identity-related alerts, and more, into a centralized repository, focusing only on what’s useful.

Security Event Management (SEM), in contrast, analyzes these logs in real time, detects anomalies, and guides response actions.

Together, SIM and SEM transform raw data into actionable threat intelligence, enabling organizations to detect, investigate, and respond to security incidents more effectively.

In addition, SIEM systems process data through stages:

1. Determining the Data Types

2. Data Ingestion

3. Storage

4. Parsing

5. Normalization

6. Indexing

It all starts by identifying Data Types. This just says that data in a SIEM can be structured, semi-structured, or unstructured.

1. Structured - with predefined schema that’s easy to analyze (e.g., firewall logs, Windows Event Logs, SQL tables)

2. Semi-structured - partially organized for easier parsing (e.g., JSON/XML logs, cloud events, IoT data).

3. Unstructured - lacking a set schema and requiring advanced processing (e.g., emails, images, audio/video)

When choosing SIEM, focus primarily on structured data while remembering that semi-structured and unstructured data can enhance visibility; always verify that the platform supports your log formats, because if it can’t ingest them, it can’t generate insights. Although modern solutions like Microsoft Sentinel can handle custom schemas and virtually any log format via APIs

Data Ingestion

After identifying data types, the next phase in SIEM Data Processing is Data Ingestion.

What comes to mind when thinking of ingesting data?

Is it just collecting from various sources and bringing them into a system?

Well…

Data Ingestion is simply the process of collecting data from various sources and loading it into the SIEM’s central repository for storage, processing, and analysis.

Most SIEMs support three main data ingestion methods:

1. Agent-based Ingestion

2. File-based Ingestion

3. API-based Ingestion

Let’s break down each model/method.

Three Primary Methods

1. Agent-Based

Agents are installed on endpoints such as Windows, Linux, Mac, and other agent-supported machines. Once installed, it collects logs locally and sends them to the SIEM’s central repository.

The agent installed on a machine acts as a connector or forwarder, collecting and sending logs to the SIEM.

The thing is, different vendors use different names when describing an agent:

• Splunk: Forwarder

• Microsoft Sentinel: Azure Monitor Agent

Bear in mind:

Marketing terminology varies, but the concept is the same: the agent acts as a connector between the endpoint and the SIEM.

And in reality, marketing changes faster than any single definition can capture, which is why different terms are often used to refer to it. Alas, this is where confusion arises.

Collector vs Connector Architectures

For the Agent Method, SIEM data collection typically uses one of the two setups:

1. Direct Forwarding

2. Collector Model

Direct Forwarding

In Direct Forwarding, Agents send logs straight from each device to the SIEM.

• Machine X sends logs to SIEM.

• Machine Y sends logs to SIEM.

So, each device is configured to forward logs straight to the SIEM Collector.

• Pros:

  • Simple Architecture, Low Latency

  • Event logs reach the SIEM quickly

• Cons:

  • Potential bottlenecks (SIEM must handle all logs soruces simultaneusly)

  • Limited flexibility for pre-processing or normalization.

Collector Model

In the Collector Model, multiple machines send logs to a central collector, which then forwards them to the SIEM.

• Machine X sends logs to Machine Z.

• Machine Y sends logs to Machine Z.

• Machine Z (Collector) then sends logs to SIEM.

Here, Machinge Z hosts an agent that collects logs from other machines before sending them to the SIEM.

• Pros:

  • Reduces SIEM load.

  • Enables pre-processing, filtering, and aggregation.

  • Provide redundancy in distributed networks.

• Cons:

  • Slightly higher latency due to the extra hop.

SIEM Evaluation: Agent Types

SIEMs may either:

• Use separate agents for the connector(direct forwarding) and collector roles, or

• Use a single agent that is capable of performing both functions.

Thus, aside from determining which logs are supported by the SIEM (Identifying Data Types), other key evaluation questions are:

• How many agent types are required?

• Can one agent perform both roles?

• Does the agent support automatic updates?

Fewer agent types reduce administrative overhead and simplify patching and lifecycle management.

For Instance:

Microsoft Sentinel’s Azure Monitor Agent handles both connector and collector roles and updates automatically.

2. File-Based Ingestion

Consider an application that:

• Runs across multiple endpoints.

• Consolidates security-relevant logs into a central file (e.g., log.txt)

• Support lacks direct SIEM integration.

In this scenario, we can deploy a connector/collector on the server holding the log file. Here, the agent is set-up to:

• Monitor the file

• Extract relevant log data.

• Forward it to the SIEM.

Most modern SIEM platforms support this method.

For instance:

Microsoft Sentinel uses the Azure Monitor Agent with Data Collection Rules (DCRs) for handling file-based ingestion.

3. API-Based Ingestion

Suppose you have a web application and want its logs sent directly to your SIEM.

Most modern SIEMs support API-based ingestion, which generally works as follows:

1. Authenticate using a client ID and secret (or service account)

2. Connect to the SIEM’s authorization endpoint.

3. Send the data payload to the ingestion endpoint.

4. The SIEM stores the data in its centralized repository.

For instance:

Microsoft Sentinel supports API ingestion, as long as the payload is formatted in JSON.

Bottom Line

Choosing the right ingestion method depends on your environment, log sources, and SIEM capabilities.

Hence, when selecting a SIEM solution, we tend to focus on:

• Agent Complexity

• Update Management

• Architectural Flexibility

• Ease of Integration

And most SIEM platforms support three ingestion models: agent-based, file-based, and API-based.

It probably wonders… “What use could this be?”

Or… “Would this help open that thing?”

The crow is likely engaging in some problem-solving and/or just playing, experimenting with objects to learn about its environment. Maybe it’s figuring out how to weigh something down, crack a nut, or see what happens if it drops it from a certain height. Curiosity and intent mix in every twitch, every tilt of the head, until finally, it lifts off from an electric line, stone still in beak, carrying thought into the air.

And in watching it, there’s a subtle lesson for us too. Insight, curiosity and intelligence often appear in small, unassuming gestures. Even a single stone, held in a bird’s beak, can hint at depth, resourcefulness, and the quiet art of observation.

Subscribe now

How is data processed in a SIEM System?

To begin, as you may already know, a SIEM (Security Information and Event Management) solution is composed of two core components: SIM and SEM

SIM (Security Information Management) focuses on the collection and management of security logs or data. Its primary role is to gather security logs from various defined sources across the environment and store them in a centralized repository.

However, log collection should never be random or excessive. We do not simply ingest everything without purpose. Instead, log sources must be intentionally selected and clearly defined.

For example:

• From Active Directory, we may choose to ingest failed login attempts to detect potential brute-force attacks.

• From an Identity Protection tool, we might ingest all alerts, regardless of severity.

The point is, this approach requires careful planning to answer these essential questions:

• What logs should be collected?

• Why are we collecting them?

• What security value do they provide?

Bear in mind:

The deliberate process of collecting, organizing, and managing relevant security logs on a centralized platform is known as Security Information Management (SIM).

Once the data has been collected, SEM or Security Event Management comes into play.

SEM focuses on analyzing and responding to security events derived from the collected logs. It provides a structured framework for monitoring, detecting, and responding to potential threats.

This includes activities such as:

• Creating Detection Rules

• Identifying Anomalous Behavior

• Writing Queries for Deeper Investigation

• Following Incident Response Procedures

• Initiating Recovery or Remediation Actions

Together, SIM and SEM form the foudnation of a SIEM system, transforming raw security logs into actionable intelligence that enables organziation to detect, investigate, and respond to security threats more effectively.

Photo Courtesy of ManageEngine

Check out Part 1 here:

Data Processing in a SIEM Solution

Now, returning to our main question:

How is data processed in a SIEM System?

Data processing in a SIEM solution generally goes through several stages:

1. Data Types

2. Data Ingestion

3. Data Storage

4. Data Parsing

5. Data Normalization

6. Data Indexing

Each stage plays an important role in transforming raw logs from various sources into structured and searchable data that SOC teams can analyze effectively.

For this write-up, we’ll focus on the first stage: Data Types

Three Main Types Of Data

Data processed in a SIEM system generally falls into three categories:

1. Structured Data

2. Unstructured Data

3. Semi-structured Data

1. Structured Data

Structured data follows a predefined schema, meaning the format and fields are clearly defined.

This makes it easier for systems to parse, analyze, and query the information.

In security environments, most logs generated by infrastructure and applications fall into this category.

Examples include:

• Firewall / Antivirus / Antimalware logs (timestamp, event type, source IP, destination IP)

• Active Directory User Login Records

• SQL Database Tables

• Windows Event Logs

• Syslog

• Custom Logs

• CEF or Common Event Format Logs

2. Unstructured Data

Unstructured data does not follow a predefined schema.

Because the format is not standardized, extracting useful information often requires manual review or advanced processing techniques such as machine learning or natural language processing.

For example, reading the contents written on a whiteboard from an image would be considered an unstructured data task.

Examples:

• Images (such as objects or CCTV footage)

• Emails, Chat Messages, or Documents

• Audio or Video Recordings

• Social Media Posts

3. Semi-structured Data

Semi-structured data sits somewhere between structured and unstructured data.

While it does not follow a rigid schema like structured data, it still contains identifiable attributes or metadata that provide some level of organization.

Examples include:

• JSON or XML log files

• Cloud Service Logs (such as AWS or Azure Resource Events)

• Sensor or IoT device data

• Metadata associated with images or files (Fromat, size, location)

In the context of security, most attention is given to structured data.

That said, there are still ways to extract meaningful information from unstructured and semi-structured data.

Start Here: What to confirm with your vendor before anything else

When evaluating a SIEM solution for your enterprise, one of the first questions you should ask is:

Which log formats are supported?

Why is this important?

Consider the following scenario.

In your environment, there are multiple security solutions, and each of them generates logs in different formats, such as:

• Windows Event Logs

• Syslog

• Custom JSON logs

• Common Event Formats (CEF)

When assessing a SIEM platform, verifying support for these formats should be a priority.

For example:

You: What is the list of all the supported log formats?

Vendor: Here’s the list…

This simple question can immediately reveal whether the solution can integrate effectively with your existing environment.

Consider another scenario:

• Vendor A supports custom log ingestion, including JSON-based logs.

• Vendor B does not support custom data injection.

In this case, Vendor A would clearly be the better choice.

After all, if a SIEM platform cannot ingest your data, it cannot analyze it or generate meaningful security insights.

Image Source: Microsoft Azure

In the context of Microsoft Sentinel, the platform is even more flexible.

Sentinel can ingest data in any format or schema, including JSON logs.

You can define a custom schema to map specific attributes and values, and leverage data injection APIs to automatically feed security-relevant logs from your applications into Sentinel.

In practice, this means Sentinel can handle virtually any log format your enterprise produces.

Image Source: Concepts Work

Wrap Up

Choosing the right SIEM solution starts with understanding how it processes data. At its core, a SIEM relies on SIM to collect and manage logs, and SEM to analyze and respond to security events.

When evaluating solutions, pay close attention to supported log formats. If a platform cannot ingest your data, it cannot analyze it, no matter how advanced its analytics are. Structured data will always be the primary focus for security monitoring, but the ability to extract insights from semi-structured or unstructured data can provide additional visibility.

Ultimately, a flexible, well-integrated SIEM allows your organization to turn raw logs into actionable intelligence, helping detect threats faster and respond more effectively.

How do you identify what could go wrong, what assets are at risk, and what the potential business impact might be?

This is where Security Risk Assessments come in.

Security Risk Assessments are a critical component of any project involving information systems, applications, or infrastructure.

A security risk assessment helps answer key questions:

• What assets are involved in this project?

• What threats could target those assets?

• What vulnerabilities might those threats exploit?

• How likely is an attack to occur?

• What would the impact be if it did?

• And most importantly, how should the organization respond?

In the following sections, we will walk through a practical approach to performing security risk assessments on projects, from defining scope and identifying assets to evaluating risks, determining treatment strategies, and maintaining a risk register.

Photo courtesy of Great Learning

Solid Starting Point

When conducting a Security Risk Assessment for any project, whether new or ongoing, it is crucial to understand both cybersecurity frameworks and the SDLC (System Development Life Cycle).

Examples include:

• NIST SP 800-30

• ISO/IEC 27001

• ISO/IEC 27005

• NIST SP 800-64

As well as development approaches (SDLC models) like:

• Waterfall

• Agile

Foremost, Security Risk Assessment aims to embed security (secure framework guides) into each phase of the SDLC.

What does it mean?

In essence, SDLC is a structured, multi-step process for developing, implementing, maintaining, and retiring information systems.

Thus, Security should never be a mystery or an afterthought. It must be integrated before, during, and after each phase of the project.

And security work is both cyclical and transformative, requiring continuous monitoring and improvement.

Hence, a solid starting point is simply understanding your chosen framework and SDLC model.

Define the scope and business context.

Establish what the project is all about.

Why does the project exist?

What does it mean to achieve?

What environment does it operate in?

This sets the foundation for meaningful risk assessments and security planning.

Are we reviewing a new cloud deployment?

Assessing risks in a new banking system?

Evaluating a new API or web application?

Asset Identification and Data Classification.

In every project, there are assets involved, and these assets generate logs, or simply data.

And it is imperative to identify the assets and classify the data it generates.

This includes:

• Infrastructures:

  • Servers: Linux, Windows, Mac, etc.

  • Storage Devices

  • Network Equipments

  • Environment: Cloud, On-Prem or Hybrid.

• Applications

  • Web Apps

  • APIs

  • Internal Software

  • SaaS platforms

• Data

  • By location/state: At rest, in transit, in use

  • By type: structured (databases), unstructured(documents, emails), semi-structured (JSON, XML)

• Personnel

  • Key roles such as network and system administrators, developers, and information security teams.

After determining, we must assign values based on sensitivity and importance to the organization.

• Sensitivity: Public, Internal, Confidential, Highly Confidential

• Importance: Criticality to business operations, legal or regulatory impact, and reputational risk.

Let’s say:

• Cloud-based HR database - Highly Confidential, Critical to Business

• Internal Web Portal - Internal, Medium Importance

• Network Switch Configuration - Confidential, High Importance

• Security Admin Account - Highly Confidential, Critical

Threat and Attack Vector Identification.

Once assets are classified, it’s time to map potential threats and attack vectors to those assets effectively.

Consider:

1. Internal vs External Threats

   Internal Threats: Insider misuse, accidental errors, policy violations, misconfigurations, process failures.

   External Threats: Cyberattacks, Third-Party Breaches, Supply Chain Risks, Malware, Phishing, or Unauthorized Access

2. Attack Vectors

   Identify how threats could exploit assets.

   • Technical Vectors: Vulnerabilities in servers, applications, networks or cloud configurations

   • Human Factors: Social Engineering, Lack of Training, Weak Access Controls, or Poor Process Adherence

Questions to ask:

• Could this asset be compromised through insider misuse or human error?

• Could it be exposed via cyberattacks, third-party breaches, or supply chain weaknesses?

Considering both technical and human factors ensures a more comprehensive view of risk and helps prioritize mitigations.

Vulnerability and Gap Identification.

Next, assess the system for vulnerabilities and weaknesses that the identified threats could exploit.

This includes:

• Technical Vulnerabilities: Outdated software, unpackaged systems, misconfigurations, insecure settings, or weak encryption.

• Process gaps: Missing policies, inadequate procedures, or inconsistent enforcement.

• Control gaps: Lack of monitoring, insufficient access contorls, or weak segregation of duties.

Use a combination of tools, audits, and historical data to uncover these gaps:

• Vulnerability scanners (e.g., Nessus, Qualys)

• Penetration testing results

• Security audits and compliance reports

• Past incident and breach history

Identify areas where current defenses are insufficient, so you can prioritize remediation and strengthen controls.

Create Threat-Vulnerability Pairs

At this stage, link each threat to the vulnerabilities it could exploit to form threat-vulnerability pairs.

Assess Likelihood

Next, assess the likelihood or probability that each vulnerability could be exploited, considering factors such as:

• Exposure: Is the asset internal, external, or internet-facing?

• Existing Security Contorls: What protections (firewalls, access controls, monitoring) are already in place?

• Threat Landscape: Are there active threats targeting this type of asset or system?

• Ease of Exploitation: How difficult would it be for an attacker to exploit this vulnerability?

• History of Similar Incidents: Have similar attacks occurred in the organization or industry?

The likelihood assessment helps prioritize risk based on the probability that a threat could successfully exploit a vulnerability.

Conduct an Impact Analysis

Once the likelihood is assessed, evaluate the potential impact if a risk materializes, considering multiple dimensions:

1. Regulatory Impact

   • Could this result in violations of frameworks like NIST or ISO certifications?

   • Non-compliance penalties or audit failures

2. Financial Impact

   • Fines or legal penalties

   • Revenue loss

   • Costs for remediation and recovery

3. Operational Impact

   • Service disruptions or downtime

   • Reduced productivity

   • Delays in project or business operations

4. Reputational Impact

   • Damage to brand or public image

   • Erosion of customer trust.

Risk Calculation and Prioritization

Core Formula:

Risk = Likelihood x Impact

This is typically represented using a risk matrix to prioritize attention.

Likelihood Rating:

Rare, Possible, Likely, Almost Certain

Impact Rating:

Low, Medium, High, Critical

This is generally a qualitative analysis that provides a clear view of which risks require urgent mitigation.

While the standard approach is qualitative, organizations can adopt a quantitative approach to assign monetary or numerical values to risks.

Frameworks such as FAIR (Factor Analysis of Information Risk) provide a structured method to quantify risk in financial terms, rather than just Low/Medium/High.

Quantitative Analysis evaluates:

• PLM - Probable Loss Magnitude: Estimated financial impact if a risk occurs

• LEF - Loss Event Frequency: How often a risk might materialize

• Exposure: Internal vs External threats, critical systems affected

The advantage of using FAIR or similar models is the ability to prioritize risks based on potential financial consequences, supporting better investment and mitigation decisions.

Determine Inherent Risk

Once likelihood and impact have been assessed, calculate the inherent risk for each identified threat or vulnerability.

Inherent Risk represents the level of risk before any contorls or safeguards are applied.

It reflects the raw exposure of assets based on existing threats and vulnerabiliteis.

Understanding inherent risk helps prioritize which risks require the most urgent attention.

Again, the formula:

Inherent Risk = Likelihood × Impact (without considering existing controls).

Define Existing Controls

When it is needed to identify the security controls that are already in place to protect assets and mitigate risks, remember that these security controls can be grouped into categories:

1. Technical Controls

   These controls are implemented through technology and systems to protect assets and data.

2. Managerial Controls

   These controls focus on policies, procedures, and governance to manage and direct security efforts.

3. Operational Contorls

   These controls involve people and processes that support day-to-day security enforcement.

4. Physical Controls

   These controls protect physical assets and facilities from unauthorized access or damage.

More on this:

Determine Residual Risk

After assessing inherent risk and documenting existing contorls, calculate the residual risk.

Residual Risk is the level of risk that remains after contorls are applied.

Residual Risk shows the exposure that persists despite technical, administrative, and physical safeguards.

Formula:

Residual Risk = Inherent Risk − Control Effectiveness

This helps prioritize additional mitigation measures for risks that remain high even after current contorls.

Hence, Residual Risk reflects the actual risks the organization faces after accounting for all implemented contorls.

Risk Treatment or Mitigation Strategies

After assessing inherent risk, existing controls, and residual risk, the next step is to determine how each identified risk should be handled.

Organizations typically apply one or more of the following risk response strategies:

1. Risk Transfer

2. Risk Acceptance

3. Risk Avoidance

4. Risk Mitigation (Risk Reduction)

Risk Transfer

Risk transfer involves shifting the financial or operational burden of a risk to another party.

The risk itself still exists, but responsibility for managing its consequences is partially transferred.

Examples:

• Purchasing Cybersecurity Insurance

• Outsourcing Security Operations to an MSP or Managed Service Provider.

In this case, another organization assumes part of the financial impact or operational responsibility if the risk materializes.

Risk Acceptance

Risk Acceptance occurs when management knowingly decides to tolerate a risk.

This approach is typically used when:

• The risk level is low.

• The cost of mitigation exceeds the potential impact.

• There are operational or technical constraints.

Risk Acceptance may include:

• Risk Exemptions - when a policy cannot be applied to a specific situation.

• Risk Exceptions - temporary deviations from established policies.

Examples:

• Industrial systems running unsupported Windows versions where vendor patching is not permitted.

• Delaying patches beyond the defined policy window due to application compatibility issues.

Risk Acceptance must always be formally documented and approved by business owners or risk owners, not solely by IT teams.

Risk Avoidance

Risk Avoidance means eliminating the activity that introduces the risk.

By removing the exposure entirely, the risk no longer exists.

Examples:

• Choosing not to deploy a high-risk application.

• Removing internet connectivity from sensitive systems.

Risk Mitigation (Risk Reduction)

Risk mitigation focuses on implementing security controls to reduce either the likelihood or the impact of a risk.

The risk still exists, but it is reduced to an acceptable level.

Example:

• Deploying NGFW or Next-Generation Firewalls.

• Implementing MFA or Multi-Factor Authentication.

• Applying Network Segmentation

• Using Data Encryption

Maintain a Risk Register.

Finally, document and track all identified risks in a risk register, which serves as the organization’s formal risk reporting mechanism.

A risk register typically includes the following elements:

• Risk Description - a clear explanation of the identified risk

• Likelihood - the probability that the risk may occur

• Impact - the potential consequences if the risk materializes

• Risk Rating - the overall risk level, often determined using methodologies such as NIST SP 800-30 or ISO/IEC 27005.

• Risk Owner - the individual responsible for managing the risk

• Treatment Strategy - the chosen response (Accept, Transfer, Mitigate, or Avoid)

• Target Remediation Date - the expected timeline for addressing the risk.

• Status - Current progress (Open, In Progress, Mitigated, Accepted, Closed)

The risk register is not a static document; it:

• Is continously updated as new risks are identified or existing risks change.

• Is reviewed regularly by senior management and risk committees

• Guides budget allocation and business decisions related to security and risk management

• Tracks both critical and emerging risks across the organization.

In practice, the risk register becomes the central record for monitoring, communicating, and managing risk over time.

Continuous Monitoring and Improvement.

Risk Assessment is not a one-time activity (unless it is an ad hoc type assessment); it requires continuous monitoring and ongoing improvement as systems, threats, business environments and priorities evolve.

To be effective, the risk assessment process should ensure:

• Repeatability - the methodology can be applied consistently across different projects and over time.

• Traceability - decisions, risk ratings, and mitigation actions can be tracked back to their sources and supporting evidence.

• Audit Defensibility - the process and results can withstand internal or external audits and demonstrate compliance with recognized standards.

• Executive-Level Clarity - findings and risk priorities are communicated in a clear, concise way that enables leadership to make informed strategic decisions.

This approach ensures that risk management remains structured, transparent, and aligned with organizational objectives, while continuously adapting to new risks and changing conditions.

More about improving risk assessment:

If a solution can collect and manage security data (SIM) and can detect, investigate, and respond to security events (SEM).

Then it is a solution that qualifies as a SIEM (Security Information and Event Management).

Put simply, a SIEM does five core things:

1. Collect the Right Data.

2. Analyze it Effectively

3. Detect Anomalies

4. Investigate Incidents

5. Respond and Recover

Voila! That’s the full picture.

Now, let’s take the SIEM apart piece by piece and make sense of it.

Photo Courtesy of ManageEngine

SIEM: The Pillar of a SOC

From an operational standpoint, a SIEM platform is one of the most crucial components of a Security Operations Center (SOC).

In practice, most SOC workflows, procedures and day-to-day operational activities are heavily shaped by the capabilities and design of the SIEM solution in place.

SIEM doesn’t just support the SOC. It defines how the SOC operates.

It’s the central nervous system of SecOps.

It directly influences how analysts monitor alerts, investigate incidents, prioritize threats, and execute response procedures daily.

So, yes, being a SOC analyst means you’ll likely spend the majority of your time in the SIEM console, monitoring alerts, investigating events, and managing incidents.

It’s rad.

Your visibility.
Your detection capability.
Your investigation depth.

It all depends on the SIEM.

However, things need to be structured and efficient. Choosing the right SIEM solution can make or break your SOC.

To make the right choice, it’s necessary to get the basics down.

What is a SIEM?

Why does it exist?

How does it actually work?

Making Sense of SIEM

As you already know, SIEM stands for Security Information and Event Management.

At first glance, it sounds like a single concept.

But it’s actually a combination of two distinct components:

SIM - Security Information Management

SEM - Security Event Management

SIM – Security Information Management

SIM focuses on collection, storing, and managing security data.

Essential functions:

• Log aggregation from multiple sources.

• Data normalization and retention

• Historical analysis for trends and compliance

SEM – Security Event Management

SEM focuses on detecting, monitoring, and responding to security events in real time.

Functions include:

• Event correlation and alerting

• Real-time monitoring and dashboards

• Incident investigation and response

Comprehending SIM and SEM individually is key to appreciating the full power of a SIEM.

It’s more than just a tool. It’s the fusion of robust data management and real-time security intelligence that drives a modern SOC.

It All Starts with Logs

In production, there are multiple digital/cyber domains and solutions.

Domains such as:

• Identity (Active Directory)

• Network (Routers, Switches, Firewalls, Proxies)

• Applications (ERP System - SAP, NetSuite)

• Infrastructure ( Cloud Providers, On-Prem Data Centers)

• Data (File Servers, OneDrive, Google Drive)

• Endpoints (MDM, Laptops, Servers)

Each of these domains or systems generates logs, and many of them provide valuable security context.

In addition to operational systems, enterprises also deploy dedicated security solutions, such as:

• Identity (Identity Protection - Microsoft Defender for Identity, CrowdStrike)

• Network (IDS/IPS)

• Applications (CASB - Cloud Access Security Broker)

• Infrastructure (CSPM/CWPP - Cloud Security Posture Management/Cloud Workload Protection Platform)

• Data (DLP - Data Loss Prevention)

• Endpoints (Endpoint Protection Platform - AntiVirus / EDR - Endpoint Detection and Response)

In reality, most enterprises operate 15 or more security-related solutions, all generating logs that could be critical for detection, investigation, and compliance.

Generated Log Types From Each Domain.

As mentioned, each digital domain or system generates logs that can provide valuable context.

These Log Types may be:

• Identity Logs

  • User Account Creation

    • Identity Creation

    • Group Creation

    • Role Creation

  • Privilege Provisioning

  • Login Attempts

  • Deprovisioning

• Network Logs

  • VLAN Creation

  • Route Creation and Change

  • WLAN Creation

  • Access Requests

  • Firewall Events

  • External Network Service Tiering

• Application Logs

  • User Provisioning

  • Authorization Changes

  • Enabling Specific Application Capabilities

  • Code Modifications

• Infrastructure Logs

  • DNS, DHCP, File Servers

  • Cloud Activity

  • Resource Provisioning

• Data Logs

  • File Creation

  • Data Classification

  • Data Protection

  • Encryption Events

  • Data Sharing

• Endpoint Logs

  • Device Onboarding

  • Device Compliance

  • Device Configuration

  • Registry Changes

  • Application Installation

  • Command-line Activity

  • Changes to File Events

Take it easy. These are simply examples of what systems record about what’s happening, so administrators or security tools can monitor, troubleshoot, and investigate later.

After all, Log Generation is the process by which systems, applications, or devices automatically create records (logs) of events and activities that occur within them.

Security Information Management (SIM)

Now, imagine collecting logs from all these sources into a centralized repository.

But this collection process has to be intentional. We don’t just ingest every log without thinking.

So, what does that actually mean?

It means we carefully decide which logs are valuable; the ones that help with monitoring, security detection, troubleshooting, and compliance.

Not every log is useful, and collecting everything can create noise, consume storage, and make analysis harder.

In other words, we prioritize the logs that matter most so that administrators and security tools can focus on meaningful events rather than drowning in unnecessary data.

In terms of Identity Logs:

You may ingest failed login attempts from Active Directory to detect brute-force attacks.

But, from an identity protection tool or solution, you may ingest all alerts regardless of severity.

Again, for this reason, careful planning is required.

We must thoughtfully determine:

• What logs should be collected?

• Why are we collecting time?

• How do these logs provide security value?

Furthermore, information from carefully selected logs across different domains and solutions can help with Data Enrichment, adding context that makes security analysis more effective.

Ultimately, this deliberate process of collecting, storing, and managing security-relevant logs in a centralized system is called SIM (Security Information Management).

What Happens After Collection? Security Event Management (SEM)

Once data is collected, the next step is to put it to work by:

• Creating Detection Rules (Conditions to Detect Anomalies)

• Identifying Anomalies

• Writing Queries For Deep Investigation (Deep Search)

• Following Response Procedures

• Initiating Recovery Actions

This structured handling of security events is known as SEM or Security Event Management.

Interestingly, many of these activities map directly to the NIST Cybersecurity Framework functions, such as Identify, Detect, Protect, Respond and Recover; showing how SEM connects daily operations to broader cybersecurity goals.

All Tied Up

Once more, here’s what SIEM is, end-to-end:

If a solution can collect and manage security data (SIM) and can detect, investigate, and respond to security events (SEM).

Then it is a solution that qualifies as a SIEM (Security Information and Event Management).

Put simply, a SIEM does five core things:

1. Collect the Right Data.

2. Analyze it Effectively

3. Detect Anomalies

4. Investigate Incidents

5. Respond and Recover

Voila!