Writeups from the engineers shipping the code.
Production-grade patterns, post-mortems, and migration playbooks. Real numbers from real engagements, written so a senior engineer at your shop can apply them in a week.
Azure Log Analytics Workspace: Design Decisions That Matter at Scale
A Log Analytics Workspace is the foundation of every Azure monitoring and SIEM deployment. Get the workspace topology and cost controls wrong early and you pay for it for years.
Microsoft Sentinel Pricing: Where the Bill Comes From and How to Control It
Sentinel's ingestion model punishes noisy data sources fast. Here's how to read your actual bill, pick the right commitment tier, and use tiered log storage to cut costs without losing detection coverage.
Microsoft Sentinel Training: What Actually Matters in the Field
Most Sentinel courses teach the portal tour. This field note covers what engineers need to operate Sentinel at production scale: KQL, rule testing, cost control, and detection gaps.
Microsoft Sentinel Pricing: What You Actually Pay and How to Cut It
Sentinel bills on two layers most teams never model together. Here is how commitment tiers, free connectors, and Basic Logs interact — with real numbers.
Terraform Azure Storage Accounts: Footguns and Production Config
The azurerm_storage_account resource ships with permissive defaults on every security-relevant attribute. Here is how we configure it correctly before production.
Azure Sentinel Connectors: What Actually Works in Production
Getting data into Microsoft Sentinel is where most SIEM rollouts quietly fail. This field note covers connector types, AMA migration pitfalls, and DCR routing that holds up under real ingestion load.
Microsoft Azure Sentinel in 2026: the portal cutover is five weeks out
The Azure portal for Microsoft Sentinel retires July 1, 2026. This field note covers what breaks if you wait, the query migration already past due, and the new detection capabilities shipping this year.
Migrating Azure Sentinel off MMA: a field guide for production environments
MMA retires August 2024. Here's the AMA + DCR/DCE pattern we used to move fourteen custom connectors with zero ingestion gaps and half the operating cost.
Six AI-agent and RAG patterns we keep yanking out of production
Vector retrieval that returns garbage, prompt injection by way of a CSV upload, runaway token bills. Patterns to avoid, with the fix that actually shipped.