20 illustrative reference designs. Employer and client implementations stay private. Explore my experience by area.
6 studies
Security & detection
Detection platforms
How can Python detections run safely and repeatably?
Read the studySecurity data
How can a SIEM search quickly without losing the evidence?
Read the studyBehavioral analytics
When is unusual behavior worth investigating?
Read the studyAsset context
Which observations belong to this asset, and when?
Read the studyInvestigation flows
How does an alert become a defensible case?
Read the studyDetection testing
What does a passing detection test actually prove?
Read the study6 studies
Data & platforms
Data contracts
What can a consumer safely assume about an event?
Read the studyRecoverable pipelines
What happens when processing stops?
Read the studyData freshness
How fresh does this data need to be?
Read the studyFederated queries
What does one query across several sources actually guarantee?
Read the studyData catalogs
What makes a catalog useful after the first metadata scan?
Read the studyPlatform operations
Who keeps a shared platform working when workloads and releases change?
Read the study5 studies
Applications & tools
Enterprise search
Where does the search engine end and the application begin?
Read the studyData APIs
How can applications share data without sharing database access?
Read the studySelf-service tools
What makes a self-service action safe to repeat?
Read the studyService integrations
How do integrations keep working after the first successful call?
Read the studyDocument processing
When is extracted content ready for another system to use?
Read the study3 studies
AI & agents
