Ops Log tag
#SMB
Reviewed Ops Log notes tagged SMB, written by Michal Jatczak with source links, test context and operational checks.
3 reviewed notes
An incident-response playbook for a team without a security operations centre
A first-hours runbook for a 4 to 15 person technical team on Microsoft 365: the three EU reporting clocks and the event that actually starts each one, a containment sequence that captures evidence before it cuts access, and the documented side effects and rollback for every high-blast-radius action.
Backup after 3-2-1: immutability modes, drill cadence, and the evidence an auditor accepts
3-2-1 describes the shape of a backup estate but says nothing about its blast radius. This memo settles four decisions: compliance-mode retention over governance mode, two retention tiers sized separately, a second party on destructive operations, and a drill that leaves a dated artefact behind.
Running Prometheus, Loki and Alertmanager on one VM: configuration, retention and cost
A single-VM Prometheus, Loki, Alertmanager and Grafana deployment that starts on the first attempt: the retention flags that belong on the command line, the disk-sizing formula that decides the machine class, alert rules with the false-page guards in place, and a cost model built from published list prices instead of asserted savings.