How I take notes as a Cybersecurity Engineer — Update

Regan
3 min readNov 28, 2023

This blog post serves as a quick update to an article I wrote at the beginning of the year, as an impromptu ‘end of year wrap up’ on how that workflow went, and what changes I made and which aspects have persevered.

Obsidian Still Rocks
At the beginning of the year I introduced Obsidian and how I tend to use it in a way that eschews the standard knowledge, which is to dump every file in a big root directory and use tags and backlinks to get your way around. I decided to try and embrace it for as long as possible to see if it might click. And lo, I have since reverted back to the comfortable hierarchies of folder structures. This side-quest was interesting, but ultimately, I was thinking more about the format of my notes rather than the content itself, putting myself back into the cycle of Productivity Procrastination.

Obsidian is a wonderful application that does many different things. At it’s core it’s a note-taking tool for connected thinking, but with enough plugins and elbow-grease, it can become a bit of a ‘do-everything’ tool, much like Notion can. But due to it’s open-endedness, you can procrastinate hard. The best thing you, the reader, who is clearly interested in this topic, can do — unsurprisingly — is write. Establish your own workflow and make Obsidian work for you. The plugins can come naturally as you write and think of ways to add efficiencies. Dataview is cool, but you’re not helping yourself much by building complex queries for hours at a time when you should’ve been studying.

Readwise is Excellent!
In Part 1, I was unsure as to whether I’d keep my Notion system or continue with Readwise. Readwise being the paid solution, and Notion being kinda janky but free. I’m happy to report that I have indeed kept Readwise! I find myself constantly sending uploading Tweets to it and utilising the newish built-in Reader to triage them later. Using this as a way to document emerging threats, threat actors, and possible detection opportunities based on threat research in the wild has given me tangible value, to the point that it more than justifies the monthly $~20/AUD price tag. It also has great search that works across articles, tweets, videos and uploaded PDFs. An absolute mainstay of my workflow.

Sidebar: Readwise -> Obsidian integration
This was another feature that I thought would be really cool and useful, and in some ways it is, but I also just… haven’t used it. My detection engineering workflow is all entirely in third party systems like Jira, and so my ideation for detections and threat research doesn’t take place in the realms of Obsidian. But, a nice to have nonetheless.

Removing Personal Knowledge Silos
In the last 12 months myself and my team have made a shift towards using our shared knowledge base as the main repository for all operational Cyber knowledge. This has done wonders for maintaining our documentation, but also promoted a culture of sharing information rather than keeping it to ourselves. Because of that, I haven’t mused on Obsidian much beyond the daily notes feature, which is great for quick task tracking and mocking up diagrams with Canvas or Excalidraw.

Overall, that’s where everything has landed over the last 12 months. Much less focus on the ways of doing work, and moreso just trying to do the work, and letting the workflow manifest itself that way. This has resulted in a much more ‘minimalist’ (yuck) knowledge gathering and note-taking pipeline than before, with less moving parts to worry about. If you’re in the same or similar boat as me 12 months ago, considering taking stock of where you’re at and if you really need that one extra plugin, or to migrate to that brand new app. Try and remember why you’re here :)

--

--

Regan

Security Engineer with a focus on Microsoft Sentinel, the Defender stack, and a bit of Splunk. Opinions are my own. Hack the planet.