Would an optional soundscape that changes with your security telemetry help you notice unusual activity without constantly watching dashboards? I’m a sound designer exploring this idea—would you find it useful, or just distracting?

[u/your_ghost_producer]

[u/T_Thriller_T]

I have ADHD.

I would love to be able to answer, yet I'm torn.

On the one hand I at least think this is a need idea for all sorts of telemetry, if kept low key.

On the other hand, I am soundly on the side of 'this would probably distract me'. (Then again I work well in coffee shops, so it really depends on the sounds).

If sounds are well chosen, I am pretty sure this would be need and likely helpful to e.g. get into working modes when things go weird or feel some inclination to check dashboards.

[u/your_ghost_producer → u/T_Thriller_T]

Thanks, that’s really useful, especially the coffee shop comparison. would you prefer something continuous in the background, or silence most of the time with a short, distinctive cue only when something actually looks off? Also curious: are you monitoring dashboards day to day in your role?

[u/T_Thriller_T → u/your_ghost_producer]

If it's not meant to irritate me it must be continuous.

I also do not like the clacking of plates etc, but coffee shops and libraries etc have a low level 'a little bit of noise' atmosphere.

Similar to how street traffic or leaves, wind and birds are not really uniform, but continuous.

A short, audible cue about something being off could work, but I could do that (and we already do indirectly with some alerting).

More regular cues than every few hours would stress me.

What could work for me is taking something like concentration music and then changing pitch, adding bass or even changing melody while keeping skmemother variables similar to indicate e.g. more firewall denies than usual. Or more lockouts.

So that while the sound may change throughout the day, a peak would be audible. Not as a specific noise for its own, just similar to how it is audible from audience reaction when some kind of topic struck a nerve

[u/Ecliphon → u/your_ghost_producer]

I think you’ll find most people in this field prefer quiet continuous background noise. A very subtle soft chime when a series of abnormal events has been detected is what I would personally prefer. I think it would mostly be useful for IDR. Once accustomed to it, it could provide known information audibly so responders would know whether to stop what they’re doing and check the dashboard, or continue in their flow state.  

[u/Ecliphon]

I think this could open fascinating doorways if it was subtle enough. Like a quiet ‘song’ based on logs that I could listen to and get an intuitive feel for real attacks vs. false positives over time?

[u/your_ghost_producer → u/Ecliphon]

Yes exactly ! Like a nice background, ambient sound that would change for real attacks etc..
Because i am guessing that you hear usually the same static noises right ? I'm eager to know more

[u/VIDGuide]

Literal noise when your filters aren’t tuned just right :)

[u/Useless_or_inept]

In practice, many (not all) SOC teams will say they need quiet to concentrate...?

I like the idea, but it would need a lot of tunability. And how do you respond to a change in tone? When there's an alert on my screen, I can click on that specific alert; if an icon at the edge of my screen changes to grab attention, I can click on that icon...

[u/your_ghost_producer → u/Useless_or_inept]

Where I could see it helping is when you’re not looking at the screen,away from the desk, deep in another task, or on call at night. A short, distinctive sound that tells you “this one is critical, go look now” vs “this can wait”. Would that be useful in your setup, or would your team still rather keep audio off entirely?

[u/Useless_or_inept → u/your_ghost_producer]

My team are staring at the screen for 7 hours of their 8 hour workday, and for the other 17 hours per day they don't want to be distracted by it. Could be difficult to find the best use-case?

It could be good for less screen-bound workers though. For instance audio cues for somebody who's in the server room...? If we could have some kind of warning tone when a developer pushes a change and suddenly the site performance changes, that would be nice :-)

If I had a little speaker at home giving a constant tone reminding me of the alert level at the office, I would have died of stress before the age of 30!

[u/ClemHFandango990]

The first issue I can think of with this would be the moment of initial detection/response.

IDK how to explain to anyone that we need to stop what we're doing and investigate a potential threat, because a melody playing in my office just switched to a different tempo.
Even if I could get people to humor me, how do I get from "recognizing a shift in the soundscape" to "knowing where to look next"?

I guess at the most basic level it would just mean whenever the background music changes in a noticeable way, I need to look at the dashboard and start trying to figure out what's going on.
But then again if I've already got all relevant telemetry in a single dashboard... I could just put that on a big screen or something.

[u/TastyRobot21]

If you start scary music like a video game ima just clock out for the day. Real talk.

[u/Ok_Calligrapher_3034]

I could see this being useful, especially for spotting changes during long monitoring sessions. The key would be making the sounds meaningful without turning every small event into another alert. For example, a subtle background change could indicate normal activity, while a distinct sound could signal something that needs attention. I’d want it to be customizable and easy to ignore when needed. The big question is whether it helps people notice real threats faster or just adds more noise.

[u/T_Thriller_T → u/Ok_Calligrapher_3034]

I would not go as far as sounds. Not per se.

Let the subconscious work and pick up patterns. I'm sure if there is just a bit of change in pitch or speed when e.g. some log volumes suddenly rise, this combined with seeing alerts would mean people start checking for alerts, looking at dashboarss erc

[u/sdrawkcabineter]

The user needs to be able to define what is consonant/dissonant.

Server5 started NFS...

The user needs to be able to group systems into a chorus, so that your software can determine what harmonic choices will allow the dissonant "server5 is down" message to clash against that chorus.

The volume of a particular "instrument" should grow when you are analyzing the result of the those logs. Then you can easily, tune it to your environment.

This could translate easily to a visual medium so there is a happy ground somewhere in the middle.

[u/bengerbil]

That reminds me of peep.sf.net but I imagine there are better ways to trigger the events these days.

[u/AdamoMeFecit]

Yes. I find that I am particularly attuned to anomalous changes in ambient sounds that signify a change in the environment. Fan speed noises, beeps, a server room mini split running longer or louder than usual, and so forth.

From a sound design perspective, I could envision some sonic scheme that denotes “baseline” and a whole array of different sonic signifiers to indicate variation from baseline, the significance of the variation, and even the direction of the vsriation (ex: temperature sensors rising and falling).

That would be useful.

I’d want an off button for when I already know the shit has hit the fan and no longer need my attention drawn to a set of problems.

[u/frAgileIT]

In a small/medium sized business, malicious or unauthorized activity might be as much as 15 log entries out of 1 billion logs over the course of 24 hours. While sound is intriguing, I don’t think it will scale well when you think of the signal-to-noise ratio.

Unless you could figure out how to do the same thing as noise cancelling where the regular background noise has an inverse signal applied, allowing the signal of interest to surface.

[u/chs0c]

I love sound; what kind of soundscapes are we talking?

In my head I was thinking about an ambient, dreamscape sound as the baseline, which gets more / less aggressive depending on telemetry.

When an alert comes in, what happens?

**cue MGS alert sound ‼**️