Field notes and practical architecture guidance

Working notes from enterprise and industrial network security — incidents, architecture decisions and the details vendor documentation leaves out.

Industrial tank farm at dusk with a digital-twin wireframe overlay, representing OT log telemetry flowing to a SIEM.

8 min read

Strata Logging Service to Microsoft Sentinel: the DCR migration

Forwarding Strata Logging Service logs to Microsoft Sentinel over the Log Ingestion API, step by step — data collection endpoint, DCR schema, service principal, and the 204-but-empty-table trap.

Palo Alto Networks · Microsoft Sentinel · Log Forwarding · Detection Engineering

8 min read

Strata Logging Service to Microsoft Sentinel: the DCR migration

Forwarding Strata Logging Service logs to Microsoft Sentinel over the Log Ingestion API, step by step — data collection endpoint, DCR schema, service principal, and the 204-but-empty-table trap.

Palo Alto Networks · Microsoft Sentinel · Log Forwarding · Detection Engineering

10 min read

Why Automated Commit Recovery Might Not Save Your Firewall Change

Automated Commit Recovery reverted nothing during a widespread Panorama-induced outage — because the connectivity check reported success against a policy that was already blocking all traffic. What the logs showed, why it happened, and the one pre-rule that would have prevented it.

Panorama · PAN-OS · Palo Alto Networks · Incident Analysis · Firewall Operations

Need an independent perspective on a network security challenge?

Start a conversation →