Writing · Pillar
Migration & federation.
Migrating 800 detection rules across seven parallel ingest buses. Hidden costs. The federated rollout playbook. Splunk Federated Search as bridge or lock-in extension.
Depth tier for ch7 (Modularity and migration) · 4 essays
Listed from the front door down to the measured evidence. Start here marks the entry essay. The reading-level tag says whether you are about to read the frame (Orientation), the argument (Depth), or the narrowest first-party finding (Evidence). The durability tag flags whether a number is durable architecture or an Evidence-pinned result tied to a version or price and meant to be re-run. The last tag is the provenance state — who held the pen and who checked the work — explained in full on how these are made.
- Start here OrientationDurableAI-drafted, observed
The hidden cost of SIEM migration.
The $300K project that became $1.2M. 67% of security data platform migrations require external consulting; actual costs run 40–100% above technology-only estimates. With a phased funding playbook your CFO will approve.
Read →
- DepthDurableAI-drafted, observed
The federated rollout playbook.
Federated detection at scale across business units and clouds. The ordering that works, the common mistakes that compound, and the governance discipline that keeps it coherent.
Read →
- DepthEvidence-pinnedAI-drafted, observed
Splunk Federated Search: bridge or lock-in extension?
Splunk's federated-search story positioned as the bridge to a lakehouse. What it actually does, where it's a credible bridge, and where it's a lock-in extension.
Read →
- EvidenceEvidence-pinnedHuman revised
Migrating 800 detection rules across seven parallel ingest buses.
The conversion playbook from one detection rule corpus to another while seven ingest pipelines run in parallel. What automation closes, what it doesn't, and how to phase the cutover.
Read →
