I've got a good one. I was working a "tip of the spear" job in threat intelligence (I suppose I was always on call). One of the things we monitored was DNS. It

I've got a good one. I was working a "tip of the spear" job in threat intelligence (I suppose I was always on call). One of the things we monitored was DNS. It was always noisy. If it's not the miscreants, its the normal stupidity (DNS is so amazingly survivable of misconfigurations, some of them become folk wisdom; like disabling TCP/53, but I digress). Othodox Easter Sunday morning. Really really early in the morning, like I can't remember if it was light out yet (US Pacific coast time). The SOC calls me. Nothing is happening. Nothing is happening. There is no noise. So they've been looking at this, and everything is working. So they called me. At dark-thirty on Sunday morning. I confirm everything appears to be working correctly. I repeat diagnostics, do ad hoc stress tests, everything. About two hours later the normal crap starts coming back. We have to conclude that the miscreants, as well as the sysadmins, had taken the morning off.