Technical series

Read by operational path, not only by date.

Naxaya articles are grouped into practical paths so a reader can move from context to diagnosis, implementation and runbook-level validation without hunting through the full archive.

Cloud 9 articles

Azure WAF operations

Read WAF blocks in KQL, qualify false positives, then add targeted OWASP/CRS exclusions or custom rules with evidence.

From noisy blocks to defensible WAF changes.

  1. 01 Azure WAF: read Application Gateway blocks with KQL without chasing every layer
  2. 02 WAF and KQL: identify a false positive before creating an exclusion
  3. 03 Azure WAF: add an OWASP/CRS exclusion without weakening all protection
  4. 04 Azure WAF: when to use custom rules before managed OWASP rules
  5. 05 Azure WAF: frame an emergency custom rule without losing evidence
  6. 06 Azure WAF: move a policy from Detection to Prevention without breaking traffic
  7. 07 Azure WAF: prepare an evidence pack before a policy PR
  8. 08 Azure WAF: diagnose rate limiting before increasing the threshold
  9. 09 Azure WAF: validate a managed rule upgrade before switching to Prevention
Cloud 25 articles

Azure private networking

Separate private exposure, outbound networking, DNS, Load Balancer health, Private Endpoint validation and Application Gateway troubleshooting.

Make private Azure paths testable and explainable.

  1. 01 Azure Private Endpoint: build a validation matrix before production
  2. 02 Do not confuse private exposure, outbound networking and application security on Azure
  3. 03 Azure VNet Integration: diagnose outbound networking before changing the application
  4. 04 Azure NAT Gateway: diagnose SNAT exhaustion and outbound IP drift
  5. 05 Azure Application Gateway: diagnose 502 errors without mixing DNS, TLS and backend health
  6. 06 Azure hybrid DNS: when to use Private Resolver, on-premises forwarders and private zones
  7. 07 Azure Private DNS Resolver: diagnose split-brain DNS before changing zones
  8. 08 Azure Private Endpoint: detect Terraform, DNS, and network drift before incident
  9. 09 Azure: make private paths verifiable with synthetic probes
  10. 10 Azure internal APIM: diagnose a private API before changing policies
  11. 11 Azure Container Apps: diagnose private ingress before changing revisions
  12. 12 Azure Container Apps: diagnose outbound egress before changing code
  13. 13 Azure AKS: diagnose private ingress before changing deployments
  14. 14 Azure Functions: diagnose a private HTTP endpoint before changing code
  15. 15 Azure App Service: diagnose a private endpoint before redeploying
  16. 16 Azure Storage: diagnose a private endpoint without opening the account
  17. 17 Azure SQL: diagnose a private endpoint before changing the database
  18. 18 Azure Service Bus: diagnose a private endpoint before touching queues
  19. 19 Azure UDR and NAT Gateway: diagnose egress before opening the firewall
  20. 20 Azure Firewall DNS proxy: diagnose egress before opening rules
  21. 21 Azure Firewall: diagnose a shadowed rule before opening traffic
  22. 22 Azure route asymmetry: diagnose before changing a UDR
  23. 23 Azure Route Server: validate a BGP advertisement before production propagation
  24. 24 Azure Load Balancer: diagnose a health probe before changing the backend pool
  25. 25 Azure Network Watcher: validate Flow Logs before opening an NSG rule
Automation 4 articles

Automation guardrails

Structure Ansible repositories and AWX job templates so automation stays bounded, reviewable and safe to operate.

Expose useful operations without turning AWX into a remote console.

  1. 01 AWX: design job templates that do not become a dangerous remote console
  2. 02 Ansible in production: structure an operations repository before exposing it in AWX
  3. 03 AWX: rerun a failed job without replaying a partial action
  4. 04 AWX: validate dynamic inventory before a production job
Infrastructure 44 articles

Operations runbooks

Troubleshoot Linux identity, validate Proxmox restores, rotate service identities safely, diagnose Key Vault secret references, qualify Event Grid and Queue trigger replays, validate Azure DevOps deployment gates, handle Azure Policy denies, rotate APIM subscription keys, and write handover notes that still help after deployment.

Turn architecture and infrastructure into repeatable operations.

  1. 01 Linux and Active Directory: troubleshoot SSSD failures that appear after the join
  2. 02 Proxmox Backup Server: define a testable restore policy, not only a backup policy
  3. 03 Operational architecture documentation: write a note that actually helps run after deployment
  4. 04 Monitoring: turn an alert into an actionable operations runbook
  5. 05 Azure Monitor: diagnose an alert storm after deployment
  6. 06 Azure Monitor and KQL: decide a deployment rollback without silencing alerts
  7. 07 Azure Monitor: diagnose an Action Group before silencing alerts
  8. 08 Service identity and secret rotation: a production runbook, not an isolated task
  9. 09 Azure managed identity: diagnose private access before changing permissions
  10. 10 Azure Key Vault: diagnose secret references before rotation
  11. 11 Azure Key Vault: diagnose latency and throttling before rotating secrets
  12. 12 Azure Workload Identity Federation: diagnose CI authentication before bringing back a secret
  13. 13 Microsoft Entra Workload ID: diagnose Conditional Access before excluding a CI pipeline
  14. 14 Azure Monitor: diagnose missing logs before changing alerts
  15. 15 Azure Monitor: diagnose ingestion latency before changing a KQL alert
  16. 16 Azure Monitor: validate an SLO burn-rate alert before paging on-call
  17. 17 Azure RBAC: diagnose authorization drift before widening a role
  18. 18 Azure Automation: diagnose a runbook before rerunning the job
  19. 19 Azure Functions: diagnose a Timer Trigger before replaying a job
  20. 20 Azure Durable Functions: diagnose an orchestration before replay or purge
  21. 21 Azure Container Apps Jobs: diagnose a KEDA scale rule before rerunning workers
  22. 22 Azure Logic Apps: diagnose a workflow before resubmitting the run
  23. 23 Azure Event Grid: diagnose dead-lettered events before replay
  24. 24 Azure Functions: diagnose a poison queue before replaying messages
  25. 25 Azure Managed Grafana: diagnose a dashboard or alert before changing KQL
  26. 26 Azure IaC: validate an infrastructure plan before production apply
  27. 27 Terraform: upgrade a provider without uncontrolled drift
  28. 28 Azure Deployment Stacks: validate unmanage and deny settings before an update
  29. 29 Azure Application Gateway: validate a Key Vault certificate before rotation
  30. 30 Azure DevOps: validate approvals and checks before bypassing production
  31. 31 Azure DevOps: diagnose a self-hosted agent before rerunning the pipeline
  32. 32 Azure DevOps: diagnose an offline self-hosted agent before recreating it
  33. 33 Azure DevOps: diagnose a Variable Group before rerunning deployment
  34. 34 Azure Policy: diagnose a deny before creating a production exemption
  35. 35 Azure APIM: diagnose a subscription key before rotating it in production
  36. 36 Azure Service Health: qualify a regional signal before failover
  37. 37 Azure Workbooks: diagnose observability drift before changing alerts
  38. 38 Azure Storage: validate lifecycle policy impact before deletion
  39. 39 Azure AKS: unblock a node pool upgrade stopped by a PDB
  40. 40 Azure Monitor: roll out a DCR transformation without losing telemetry
  41. 41 OpenTelemetry Collector: diagnose telemetry drops before adding memory
  42. 42 Azure Site Recovery: test a recovery plan without touching production
  43. 43 Azure Chaos Studio: bound a resilience test before disrupting production
  44. 44 Azure Resource Graph: reconstruct configuration drift before rollback
AI 24 articles

Private AI agents

Keep controls around sources, identities, tools, logs and human validation when AI agents operate inside private networks.

Make internal agents useful without making them opaque.

  1. 01 Private-network AI agent: which controls to keep around data, actions and logs
  2. 02 AgentOps: diagnose an AI agent that calls the wrong tool
  3. 03 AgentOps: expose MCP tools without losing control of production actions
  4. 04 AgentOps: diagnose MCP server drift before a production action
  5. 05 Microsoft Foundry: evaluate an agent before giving it a production action
  6. 06 AgentOps: diagnose an AI agent action before rollback
  7. 07 AgentOps: diagnose agent contract drift before redeployment
  8. 08 Azure DevOps MCP: scope an agent before letting it act on the project
  9. 09 AgentOps MCP: validate a tool schema change before redeploying the agent
  10. 10 AgentOps: diagnose missing agent traces before restoring a production action
  11. 11 AgentOps: validate a retrieval index update before it changes production answers
  12. 12 AgentOps: validate an agent tool before it can change production
  13. 13 AgentOps: rotate an agent runtime identity before tool access fails
  14. 14 AgentOps: diagnose Azure OpenAI rate limits before changing models
  15. 15 AgentOps: validate an approval policy before production actions
  16. 16 AgentOps: diagnose prompt injection in retrieval before production actions
  17. 17 Microsoft Foundry: validate guardrails before exposing an agent to production
  18. 18 AgentOps: validate agent memory before production actions
  19. 19 AgentOps: diagnose a failed tool call before retrying a production action
  20. 20 AgentOps: validate the Foundry automation handoff before a production action
  21. 21 AgentOps: validate tool output before a production write
  22. 22 AgentOps: bound MCP tool timeouts, retries and circuit breakers before production
  23. 23 AgentOps: contain an AI agent consumption runaway before shutting down production
  24. 24 AgentOps: shadow a prompt or model change before production cutover