Writing · Pillar
Migration & federation.
Migrating 800 detection rules across seven parallel ingest buses. Hidden costs. The federated rollout playbook. Splunk Federated Search as bridge or lock-in extension.
Depth tier for ch7 (Modularity and migration) · 4 essays
Listed from the front door down to the measured evidence. Start here marks the entry essay. The reading-level tag says whether you are about to read the frame (Orientation), the argument (Depth), or the narrowest first-party finding (Evidence). The durability tag flags whether a number is durable architecture or an Evidence-pinned result tied to a version or price and meant to be re-run. The last tag is the provenance state, meaning who held the pen and who checked the work, which is explained in full on how these are made.
- Start here OrientationDurableAI-drafted, observed
The hidden cost of SIEM migration.
The $300K project that became $1.2M. On the migrations I've scoped, the labor to move detection content, run two platforms in parallel, and retrain analysts ran 40–100% above the technology-only estimate. With a phased funding playbook your CFO will approve.
Read →
- DepthDurableAI-drafted, observed
The federated rollout playbook.
Federated detection at scale across business units and clouds. The ordering that works, the common mistakes that compound, and the governance discipline that keeps it coherent.
Read →
- DepthEvidence-pinnedAI-drafted, observed
Splunk Federated Search: bridge or lock-in extension?
Splunk's federated-search story positioned as the bridge to a lakehouse. What it actually does, where it's a credible bridge, and where it's a lock-in extension.
Read →
- EvidenceEvidence-pinnedHuman revised
Migrating 800 detection rules across seven parallel ingest buses.
The conversion playbook from one detection rule corpus to another while seven ingest pipelines run in parallel. What automation closes, what it doesn't, and how to phase the cutover.
Read →
