Explore a log export locally
Map timestamps, pivot on an entity and export source-linked records.
A starting point for the alert in front of you.
Short, source-backed field guides for investigation notes. Bring your local runbook, access limits and escalation policy.
The first ten minutes of an alert
A starting sequence when the queue is open and you are not sure what to check.
A suspicious sign-in is a question
Separate sign-in outcome, device context and follow-on activity.
PowerShell: process before conclusion
Work from a process chain and actual effects, with logging gaps visible.
Did the AI tool actually do it?
Separate a request, an approval, an execution record and a downstream effect.
Write the ticket you would want to receive
A worked escalation note with evidence references and an explicit next question.
Use AI to question your reasoning
Prepare a minimal, reviewed summary without sending your case notebook.
All worked examples are synthetic. These guides teach a bounded reasoning workflow; they do not diagnose a real environment. Source versions and editorial review.