KDA: Echoes of Deception - Case 4

Someone hacked Digitown's municipality and stole classified documents. 45 million rows of router traffic, an IP lookup table, and KQL's anomaly detection to find who did it.

My Toolbox - AI

I trusted AI to redesign this entire blog. The layout, the CSS, the deployment pipeline, the shortcodes. I use it to build home automation, organize my notes, fix my...

Inspecting TSQL Abstract Syntax Trees

TSQL ScriptDOM is a useful library for parsing scripts into an abstract syntax tree. I've built a web tool that helps visualize this tree as a learning exercise.
Foreword
I've leveraged...

KDA: Echoes of Deception - Case 3

The crime spree in Digitown is not ending. This time 20 cars have been stolen and we need to find where they’re stored.
The problem
This is the abridged case description....

KDA: Echoes of Deception - Case 2

The people of Digitown are being targeted by phishermen, and they need my help to stop them in their tracks.
The problem

The police have asked for our assistance, and we’ve...

KDA: Echoes of Deception - Case 1

Another KDA case: Digitown’s utility bills suddenly doubled for no good reason. With the election coming up, I got pulled in to figure out what went wrong. I’ve got...

KDA: Echoes of Deception - Onboarding

I’ll walk through the KDA UI and tackle the first challenge before diving into the real cases.
The UI layout
This is what your layout might look like:

LHS menu where you...

Kusto Detective Agency - Intro

While I mostly write about SQL Server, I have a soft spot for Kusto. In this series, I will explore solutions to fun challenges collectively known as the Kusto...

Deploy at Low Priority

Learn how to deploy schema changes in an always-online SQL Server environment without a maintenance window. This utility reduces blocking and improves deployment success.
The problem
I attempted to deploy a...

Why is fn_xe_file_target_read_file the worst SQL function?

I haven’t had a rant post in a while. There is a saying: “Anything before the word ‘but’ is ignored”. I love Extended Events, but …
reading the extended event...