The Blue Side of Documentation
summary
Created a usable SOC knowledge base by consolidating scattered Confluence pages into a prioritized training and workflow hub, assigning one owner per topic, and running a day-long doc-a-thon (pizza included); initial cleanup takes about three to four months and ongoing maintenance ~10–15% time with quarterly reviews. Tactical changes include using polarity with OCR for in-context alerts and screenshots, shifting long prose into queries-as-templates for Azure/MDE/Elastic/Palo Alto XDR hunting, and migrating to obsidian/markdown + GitHub for portable, backlinked docs.
AI-written summary · about
chapters (13)
- 0:00Documentation importance
- 1:56Chaotic Confluence pages
- 3:19Goals and priorities
- 5:28Topic owners as librarians
- 7:12Engaging structured docs
- 8:56Polarity for knowledge base
- 11:25Query-based documentation
- 13:17Lessons learned
- 16:46Future plans and tools
- 21:14Q&A ownership scaling
- 24:04Q&A maintaining quality
- 25:48Q&A expanding goals
- 27:15Q&A time tools
related talks
39mUnifying Documentation: A Tale of Two Security Giants
44mPushing documentation (so it doesn't hurt anymore)
37mTaking a step back: Analysing your documentation
51mThe No BS SOC Story
59mTransforming your Documentation Process
39mThe Documentation Dream: One Team, No Silos, Shared Goal
46mSave a Dev, Write Documentation!
47mDocumentation Is Fine, Don't Worry