Dhiraj Sharan writes about SIEM architecture and security data. Their work traces how security systems have struggled to keep up with growing, scattered data, and explains a Security Data Mesh approach that searches data where it already lives.
Most useful for explaining a Security Data Mesh and federated search approach to security analytics practitioners.
Best for
Technical thought leadership or data-mesh product campaigns aimed at SOC architects and security data engineers.
Not for
It does not fit centralization campaigns for CISOs or vendors competing with Query's product-led Security Data Mesh message.
Key takeaways
Every attempt to centralize security data eventually loses to the data.
Describe the data instead of moving it.
The SIEM should be an analytics brain, not a repository.
Check first: Confirm audience demographics and engagement data before contacting them.
Main ideas
Every attempt to centralize security data eventually loses to the data · Describe the data instead of moving it · The SIEM should be an analytics brain, not a repository
Dhiraj Sharan writes about SIEM architecture and security data.
Their posts trace a recurring problem: security data spreads across endpoints, cloud services, lakes and other systems, while architectures built around centralizing it become costly or difficult to scale.
They argue for a Security Data Mesh that describes where data lives and how to reach it, so security tools can query and combine data without first moving everything into one repository.
Follow their work for a practitioner’s account of how SIEM architecture has changed and a clear explanation of this alternative.
Sharan connects a long-running architecture problem to a proposed design and specific analyst workflows.
They explain the shift from centralized SIEM storage to federated access, then show how connector aliases and tags can help analysts target searches across many sources.
This progression makes the idea easier to assess than a general claim about data mesh: readers can follow the architectural reasoning and see a concrete example of how it might affect daily investigations.
The posts present the benefits as claims, not measured results.
Sharan’s public writing makes one argument in several forms: security data grows and spreads faster than any attempt to gather it in one place, so the architecture should describe and reach data where it already lives instead of moving it.
Read more
The claim draws on a first-person account of 25 years of SIEM rebuilds, and Sharan says the alternative—a federation layer named Security Data Mesh—has been built and refined over the last five years. A product release post shows the same idea in shipped software: federated search over Splunk and other stores, with tags and aliases that let analysts target whole groups of sources.
Every attempt to centralize security data eventually loses to the data
Sharan argues that security teams keep rebuilding SIEMs to pull data into one place, and each generation fails for the same reason: data outgrows the architecture.
Read more
The pattern emerges from a career that began as an ArcSight engineer in May 2001: a single box fed by a handful of important sources; clustering and a move from SQL to NoSQL columnar storage as the number of sources exploded; tighter pipelines that filtered out noisy events, fields and raw data in exchange for scale; batching and aggregation instead of live streaming; and, finally, a security data lake beside the SIEM. Their conclusion is blunt: centralizing security data for analytics becomes a costly, impractical, unscalable losing move every time.
The posts name endpoint, network, edge, cloud, multi-cloud and SaaS as sources. After all the rebuilds, some data sits in a legacy SIEM, some in a lake, some locked inside EDR and NDR platforms, and a lot never made it anywhere—it still sits in cloud buckets, SaaS tenants and the edge.
The follow-up post, written about a month later, restates the history and adds a diagram of the evolutionary journey.
Sharan’s proposed alternative is to stop relocating data and start describing it.
Read more
A federation layer added to the security stack creates metadata for each source—its location, content, schema and the APIs needed to reach it—makes the data discoverable and addressable, connects and joins relevant pieces, and returns results in one unified data model.
Storage, indexing, retention and scaling are decided per source rather than billed as one block for everything.
Sharan attributes the architecture to Query, calls it a Security Data Mesh, and says it has been built and refined over the last five years.
According to the post, a legacy SIEM, an existing security data lake project and an EDR deployment all fold into the approach without a major data migration. Sharan adds that AI can then work across the whole environment instead of the fraction an organization could afford to centralize.
The earlier post describes architecting toward a “quiet hope” that the SIEM would become a dataless app on top of a security data lake. The later post replaces that hope with a named, marketed architecture.
The SIEM should be an analytics brain, not a repository
If the data stays where it lives, Sharan argues, the SIEM does not need to own it.
Read more
Its role shifts from storage to analysis: it becomes the analytics layer that knows what data exists, where it is and how to reach it, then queries it on demand. This explains why the Security Data Mesh is framed as an addition to the security stack rather than a replacement for existing tools.
In Sharan’s description, the SIEM runs on top of the environment that already holds the data rather than holding the data itself, so investigations happen in place instead of requiring copies to be ingested first.
Federated search should match how analysts think about their sources
The product writing shows the same idea in daily use.
Read more
The core claim is that a Splunk environment is only as powerful as the data it can reach, and that most enterprises leave security data in lakes, object storage, EDR platforms, identity providers and cloud audit logs because ingestion costs are not justified.
The Query app connects to those sources and makes them searchable and detectable from inside the Splunk console without moving the data—“centralize the knowledge, not the data.”
The 3.0 release added a security-investigation copilot, natural-language search across federated sources without writing SPL, follow-up questions about results, such as whether something is malicious and which MITRE techniques apply, analytics across distributed stores, and OCSF-normalized results.
The 3.1 release addresses a practical irritation: with dozens or hundreds of connected sources, recalling exact connector names adds overhead.
Analysts can assign short aliases and group connectors with tags such as #edr, #identity and #env/prod, mix tags, aliases and names in one search, and exclude specific sources.
An analyst can scope a search or detection to an entire group of sources with a single tag token instead of listing connectors one by one. Sharan says the app is live on Splunkbase.
Ending posts with a question to peers, not a conclusion
Both architecture posts close by asking readers about their experience.
Read more
The retrospective asks anyone who has re-platformed a SIEM more than once what drove the work and how it is going; the follow-up invites readers to agree or disagree and says Sharan would love to learn from their experiences. The posts present the argument as open to correction by practitioners who have done the same work.
“If you've re-platformed a SIEM more than once, look back and let me know what were your driving forces.”
Start here to understand the roots of Sharan's argument.
Read more
The post answers a newcomer’s first question: why would someone spend five years proposing the opposite of what the industry has been doing? The later posts build on this account.
Sharan traces a career that began as an engineer on ArcSight in May 2001 and continued through one SIEM rebuild after another: a single box with a handful of sources, then clustering, a move from SQL to NoSQL columnar stores, tighter pipelining with filtering and batching that lost raw events, and a security data lake alongside the SIEM.
Each redesign responds to the same cause: security data grows and scatters faster than the architecture can absorb it.
Expansion across endpoints, networks, the edge, cloud and SaaS keeps defeating attempts to pull data into one place.
The turning point came five years ago, when they decided to stop centralizing.
Instead of moving data, describe it: each source, its location, its schema and the APIs needed to reach it.
Query what is needed and join the results in a unified model, leaving the SIEM as an analytics layer rather than a repository.
The post ends by asking readers what drove their own re-platforming, inviting counter-arguments.
For brands planning a campaign
This is the narrative spine for a technical thought-leadership piece aimed at SOC leaders: a practitioner's career arc turned into an argument about architecture. Treat it as a documented position, not a neutral industry view—the two later posts connect the same argument to a specific product.
This is the shortest complete statement of the architecture and its claimed outcome.
Read more
If you open only one post, make it this one, then read the earlier post for the reasoning behind it.
Building on the twenty-five-year history, Sharan proposes a federation layer inside the security stack that makes distributed data discoverable and addressable rather than moving it into a central store.
The layer holds metadata describing each source, its location, content and schema, along with the APIs that reach it.
It then connects and joins relevant pieces and returns results in one unified data model.
Storage, indexing, retention and scaling become per-source decisions instead of one bill for everything.
They say a legacy SIEM, a security data lake project and an EDR deployment can all fold into this approach without a major data migration, and that AI can then operate across the whole environment rather than the fraction an organization could afford to centralize.
The post names the architecture a Security Data Mesh and closes by asking readers to agree or disagree.
For brands planning a campaign
A compact explanation of the category and its claimed economics.
The benefits are asserted, not backed by measured migration costs or query performance.
A campaign built on this post should add those figures as proof.
Release notes are usually thin, but this one translates an abstract architecture into concrete search mechanics.
Read more
It offers the clearest view of what the Security Data Mesh does for an analyst day to day.
Sharan describes a Splunk application for reaching security data held in lakes, object storage, EDR platforms, identity providers and cloud audit logs without ingesting it into Splunk.
The 3.0 release added a copilot for security investigations, natural language search across federated sources without writing SPL, follow-up questions about results—such as whether something is malicious and which MITRE techniques apply—analytics across distributed stores, and OCSF-normalized results.
The 3.1 release targets a practical daily problem: with dozens or hundreds of connected sources in a mesh, remembering exact connector names becomes overhead.
Analysts can now assign short aliases and group connectors with tags such as #edr, #identity and #env/prod, then scope a search or detection to a whole group with one token, mixing tags, aliases and names and excluding specific sources.
The post says the app is live on Splunkbase and links a longer release write-up.
For brands planning a campaign
The alias and tag detail is the most campaign-ready material here: specific, low-risk and directly tied to SOC analysts' day-to-day frustrations rather than architecture theory. Ask for the release write-up linked in the post before making claims about measured performance or customer results.
Twenty-five years of SIEM re-architecture, told as a first-person history2
Centralizing security data is a losing bet2
The Security Data Mesh: a named architecture2
Posts end by asking peers about their experience2
Product releases as published technical updates1
Twenty-five years of SIEM re-architecture, told as a first-person history
In a post marking 25 years in SIEM — starting as an ArcSight engineer in May 2001 — Dhiraj Sharan walks through each redesign the field has been through: a single monolith fed by a handful of important sources; clustering and a move from SQL to NoSQL columnar storage as data taps exploded; tighter pipelines that filtered out noisy events, fields and raw data in exchange for scale; batching and aggregation instead of live streaming; and finally, a security data lake beside the SIEM.
Read more
They conclude that every generation lost to the same problem — data outgrowing the architecture — and that much of the data still sits where it was created, in cloud buckets, SaaS tenants and at the edge. A follow-up post the next month restates the journey and adds a diagram of the evolution.
A chronological, generation-by-generation argument: each architecture is named, its constraint described and its compromise stated plainly before readers are asked what drove their own re-platforming.
For brands planning a campaign
This retrospective is the strongest narrative asset for a technical thought-leadership campaign.
It gives a data mesh vendor a credible origin story: the approach being promoted answers a documented failure pattern.
The story can be serialized into a diagram, video or webinar without inventing new material.
Across both architecture posts, the recurring thesis is that centralizing security data for analytics "becomes a costly, impractical, unscalable, losing move.
Read more
Every time."
They point to data fragmented between legacy SIEMs, security data lakes, next-generation SIEMs that still did not scale, and EDR and NDR platforms, with a further share never collected at all.
The follow-up adds the cost of moving and duplicating data, and the limit this puts on AI, which then "performs on your whole environment instead of the fraction you could afford to centralize."
For brands planning a campaign
A crisp, contestable claim a vendor can build debate content around: point-and-counterpoint posts, a webinar with a data-lake advocate, or a discussion of data movement costs anchored to a position Sharan has already staked out publicly.
Sharan's proposed alternative is a federation layer added to the security stack.
Read more
It creates metadata describing each source — its location, data, schema and APIs — connects and joins relevant pieces, then returns results in one unified data model.
Storage, indexing, retention and scaling are decided per source rather than billed as one block.
The SIEM stops being a repository and becomes an analytics brain over data that stays where it lives; they say existing SIEMs, data lake projects and EDR platforms fold in without a major migration.
They attribute the architecture to Query, name it a Security Data Mesh, and say they have been building and refining it for five years.
Names and brands the architecture, defines it by its mechanism, then lists operational consequences: no major migration, per-source cost control and AI applied across the whole environment rather than a centralized fraction.
For brands planning a campaign
This is the core message for a data mesh campaign, and Sharan already owns the vocabulary around it. A vendor can use their definition, diagrams and five-year development claim as the campaign's spine instead of commissioning new framing.
One post announces Query Splunk App 3.1, a release aimed at more efficient investigations, and recaps 3.0: a Copilot for security investigations, natural-language search across federated sources without writing SPL, follow-up questions on results such as "Is this malicious?" and MITRE TTP mapping, FSQL analytics running across distributed stores, and OCSF-normalized results.
Read more
Version 3.1 adds short aliases for connectors and tags such as #edr, #identity and #env/prod, so an analyst can target or exclude a whole group of sources with a single token. The app is live on Splunkbase.
Before a campaign, ask for pricing, licensing and deployment specifics. The post covers features and Splunkbase availability.
For brands planning a campaign
Sharan can carry release-level content, not just opinion. That supports launch coordination, with a product moment and their architecture narrative running on the same schedule.
The posts argue through architecture mechanics: SQL versus NoSQL columnar storage, pipelining, dropping raw events and fields, batching versus streaming, schema and API metadata, federated joins, OCSF normalization, SPL and FSQL.
Read more
The source list is equally specific — endpoint, network, edge, cloud and multi-cloud, SaaS tenants, identity providers, cloud audit logs, object storage, EDR and NDR.
For brands planning a campaign
This fits SOC architects and engineering leaders rather than a general business audience. A vendor supplies product specifics while Sharan supplies framing and vocabulary, keeping technical claims traceable to someone who works in the same terms.
Both architecture posts close with a direct question.
Read more
The retrospective asks readers who have re-platformed a SIEM more than once what drove it and how the work is going; the follow-up asks whether readers agree or disagree and says they would love to learn from their experiences.
A closing discussion prompt that invites disagreement, not just endorsement.
For brands planning a campaign
Supports engagement formats: a comment thread the vendor can seed, a follow-up Q&A, or a survey built from questions Sharan already asks the audience.
Dhiraj Sharan's posts describe work built around Query's Security Data Mesh and Splunk app, and refer to their early career as an engineer at ArcSight.
Read more
No sponsorship or affiliate disclosures appear; ask whether any of these brand relationships involve paid promotion.
Query
Disclosed partnership
Sharan writes about Query's product line in the first person plural, describing “the new architecture I am proposing” as what “we at Query call a Security Data Mesh” and announcing “we shipped Query Splunk App 3.1”.
Read more
The posts present the Security Data Mesh and Splunk app as Query offerings. Ask Sharan to clarify their title, ownership stake, and employment relationship with Query.
Sharan says their SIEM career “started as an engineer in ArcSight in May 2001” and describes hands-on work re-architecting SIEM systems over the years that followed.
Read more
Ask whether they currently hold a role in the field.
Sharan describes Query's app running inside the Splunk console, with federated search over sources not ingested into Splunk, natural-language search without writing SPL, and a release live on Splunkbase.
Read more
The posts frame Splunk as the environment Query builds for. Ask whether any partnership, reseller, or sponsorship terms apply.
Dhiraj Sharan writes about security data architecture, mostly SIEM.
Read more
The clearest entry point is a retrospective marking 25 years in SIEM: it traces each generation of architecture and explains why each lost to the same problem—data growing faster than the design could handle.
A follow-up post turns that history into a proposal: stop moving security data, add a federation layer that describes each source and queries it where it lives, an approach they call a Security Data Mesh.
A product post shows the same idea in shipped software: federated search inside Splunk, with tags and aliases that let analysts target a whole group of sources at once.
Read the two architecture posts in order for the argument, then the release post for the product version.
Both architecture posts end with a question to readers, and the comment threads extend the discussion.
SIEMSecurity data architectureSecurity Data MeshData federation and federated searchSecurity analyticsSecurity data lakesSplunkSecurity operations centers (SOC)Security architects and engineering leadersFirst-person architecture essaysProduct release write-ups
Both make a first-person case about architecture: buying one tool (Databricks, Snowflake or BigQuery) does not fix the problem because the platform is deeper than most buyers assume.
Read more
They break the stack into named layers and argue that the tool license is a small part of the work. Dybalski calls tools 20 percent of the equation; Sharan argues the SIEM was never the thing that failed.
Dybalski writes about general analytics data platforms for data leaders, organizing the case as a numbered seven-layer model, from source systems to consumption.
Sharan focuses on security data, SIEM rebuilds and federated search, and names a specific architecture they say has been built over five years.
Dybalski ends with a follow prompt; Sharan ends with a question to peers who have done the same work.
Yildiz teaches security operations through hands-on practice, using SIEM and SOC tooling as the teaching material.
Read more
Their Sentinel lab post walks a beginner from an empty Azure environment to a working SOC process—data source, KQL, detection, alert, incident, investigation, response, automation—and argues that the real skill is explaining why an alert matters. Sharan makes a similar case, arguing that a career of SIEM rebuilds explains more than a feature list.
Yildiz's posts are instructional: step-by-step lab roadmaps, checklists and pentest-report guidance for analysts learning blue-team and red-team work, with the Sentinel guide credited to Blueteamers.
Sharan writes architecture-level arguments and product release notes for people who design or buy the stack.
Yildiz is the better follow for learning the daily work; Sharan for the case for changing the architecture.
Both explain complex security infrastructure to working practitioners in plain prose, build their arguments around a concrete case—Faruque with the Salesforce Agentforce ForcedLeak prompt-injection flaw, Sharan with each SIEM generation that lost to data growth—and close by inviting readers to continue the conversation.
Read more
Both translate a technical shift into a short list of actions for teams.
Faruque writes about AI-native attack surfaces: prompt injection, agentic intrusions, detection of AI systems, and the limits of pre-AI security tools.
Sharan writes about security data architecture, SIEM and Splunk.
Faruque's posts lean on numbered detection recommendations and a zero-budget tool stack, often framed around panels and events they speak at; Sharan's lean on career-history narratives and an architecture proposal.
A buyer can confirm a technical-practitioner focus, but not a verified SOC-leader audience.
Read more
The LinkedIn profile had about 5,000 followers as of 8 October 2026, and the writing targets people who already work with SIEM architecture, security data lakes, EDR and federated search.
The July 2026 post asks readers who have re-platformed a SIEM more than once to compare driving forces; the September 2026 post presents the Security Data Mesh architecture and explicitly invites agreement or disagreement; the June 2026 post is a release note for existing Splunk users evaluating connectors and search scoping.
The content speaks to security data engineers, SIEM architects and detection engineering leads.
The three posts span 17 June to 10 September 2026, roughly one per month in that window—a floor on activity, not a posting-schedule commitment.
The follower count is a single snapshot and does not establish engagement rate, reach per post or sponsored performance.
For a campaign aimed at security analytics practitioners, the account is a plausible LinkedIn channel; its overlap with SOC leadership remains unproven.
Before committing spend, ask Dhiraj Sharan for recent LinkedIn follower demographics or survey results covering job function and seniority, plus engagement results from recent posts on comparable topics—SIEM re-platforming, data federation and Splunk connector use.
If they cannot provide audience composition, budget a small test and judge by who responds, not by follower count.
LinkedIn followers
5,033
LinkedIn profile for the account the reviewed posts came from · 2026-10-08
Dhiraj Sharan's posts do not describe a sponsorship program or provide a media kit, rate card, sponsored-format description, disclosure, or official partnership inquiry page.
Read more
They do show product-led publishing: posts explain Query's Security Data Mesh architecture and announce the Query Splunk App 3.1 release.
The realistic collaboration route is a vendor or co-marketing conversation about Query's security data products, rather than a paid creator placement.
Buyers can expect architecture-level technical content for SOC, security-engineering, and security-data audiences.
Ask the vendor directly about terms, pricing, and approval process.
Good fit for a technical thought-leadership brief on security analytics or a data-mesh product aimed at SOC architects, detection engineers and security data engineers.
Read more
Sharan's published work gives a vendor an argument it would otherwise have to build from scratch: a first-person 25-year history of SIEM rebuilds, the conclusion that centralizing security data is costly and repeatedly fails, and a named alternative—a federation layer that creates source metadata, joins results in one unified model, and lets teams decide storage, indexing, retention and scaling per source.
The Query Splunk App 3.1 post adds shipped-product detail: federated search across lakes, object storage, EDR, identity providers and cloud audit logs without ingesting the data; natural-language search without SPL; OCSF-normalized results; and aliases and tags such as #edr, #identity and #env/prod to scope searches to groups of connectors.
That supports a campaign needing a credible architecture narrative and concrete mechanics.
Two qualifications matter.
The posts are product-led and name Query explicitly, making Query or a co-marketing partner the strongest fit—not a competing data-mesh vendor.
The audience evidence is a single follower snapshot of about 5,033, with no demographics.
The writing is aimed at practitioners, but the share who are SOC leaders is unproven.
Ask for audience and engagement data before committing spend.
When to choose a specialist
Poor fit for a security data lake or legacy SIEM vendor trying to persuade CISOs to centralize all security data in one platform.
Read more
Sharan's central public thesis is the opposite: centralizing security data for analytics becomes costly, impractical and unscalable; the proposed alternative is federation across distributed data.
A centralization campaign would put the creator's own words against the product claim.
A campaign aimed at CISOs would also stretch the demonstrated format.
The posts are architecture-level LinkedIn essays and release notes, not executive risk narratives or board-level business messaging.
No video, transcript or executive-audience content appears in the posts.
Audience composition is undocumented, so there is no evidence the account reaches CISOs rather than practitioners.
No sponsorship program, rate card, disclosure or official inquiry route appears in the posts, so a paid placement cannot be priced or scoped from them.
A consumer cybersecurity awareness campaign is a simpler mismatch: the posts cover SIEM, security data architecture, federated search and Splunk workflows, not consumer security.
A worked campaign example
Campaign angle for organizations choosing a data-mesh product: “The architecture that kept losing to data.”
Objective: make a data-mesh product feel like the answer to a problem SOC architects already recognize.
Sequence: (1) Lead with Sharan's 25-year retrospective as a long-form LinkedIn article or guest post.
Open with the May 2001 ArcSight start, then trace the generations: monolith, clustering and SQL-to-NoSQL columnar, tighter pipelines that dropped noisy events and raw data, batching instead of streaming, and a security data lake beside the SIEM.
End with the turn: five years ago Sharan stopped trying to centralize and started describing data in place.
(2) Publish a diagram of that evolution.
Sharan's follow-up post refers to a diagram, but it is not in the posts; the vendor should commission a clean version and have Sharan approve it.
(3) Host a technical discussion or webinar with a data-lake advocate and a SOC architect.
Use Sharan's closing question as the prompt: if you have re-platformed a SIEM more than once, what drove it, and was data volume and centralization one?
(4) Follow with a product-level post on the mechanics: federated search without moving data, per-source storage, indexing and retention, OCSF-normalized results, and aliases and tags such as #edr, #identity and #env/prod for scoping searches.
If the sponsor is Query, point directly to Query Splunk App 3.1.
If the sponsor is another data-mesh vendor, keep the first three parts as sponsored thought leadership, disclose the relationship, and set a clear boundary against endorsing a competing product.
Reader action: give SOC architects a one-page architecture comparison to take into an internal data-strategy discussion—current centralized SIEM or lake model versus federation with metadata and per-source retention—plus a short list of questions to ask vendors.
Measure practitioner response through saves, comments from security data engineers, webinar questions and requests for the comparison, not follower count alone.
Dybalski is the better choice when a campaign needs to teach a data-platform architecture argument to a mixed audience of data and analytics leaders before security specifics matter.
Read more
The reviewed post lays out seven layers of a data platform: source systems, ingestion, storage, processing and orchestration, curation and transformation, serving and distribution, and experience and consumption.
It also covers vertical concerns such as access control, data classification, lineage, pipeline cost, CI/CD and monitoring.
The post argues that buying a storage layer such as Databricks, Snowflake or BigQuery does not create a platform, and that tools are roughly 20% of the equation, with strategy, architecture and execution making up the rest.
For a security analytics vendor whose product story depends on reaching distributed data without moving it, that layered framing offers a vendor-neutral way to show why federation and per-source retention belong in the architecture.
Choose Dybalski over Sharan when data leaders need the platform layers explained before engaging with security telemetry, or when the campaign must avoid naming a competing SIEM or data-lake product.
Dhiraj Sharan's posts focus on general data-platform architecture, not SIEM, security data volumes, SOC workflows, detection engineering or security telemetry.
The two posts carry the same text, giving readers one argument rather than a range of formats or a broader body of work.
A SOC leader evaluating a data-mesh product will need security data architecture, detection use cases and campaign-ready security examples.
Ask Sharan for a security-specific argument and examples tailored to the campaign.
YILDIZ is the better choice when a campaign needs hands-on practitioner enablement rather than an architecture thesis.
Read more
The posts are a Microsoft Sentinel zero-to-SOC home lab walkthrough and a pentest report field manual.
The lab moves from an Azure subscription and a Log Analytics workspace through Sentinel enablement, Windows security logs, KQL, failed-login hunting with Event ID 4625, analytics rules, triggered incidents, investigation, automation rules and playbooks.
The pentest post argues that a report should show how compromise actually happens: scope, attack path, evidence, root cause, remediation and retest, including which tester actions the SOC should have detected.
Both are structured as step-by-step teaching, with questions for the reader.
For a security analytics vendor targeting SOC analysts and detection engineers, YILDIZ can carry a build-it, detect-it, investigate-it campaign that an architecture post cannot.
Choose YILDIZ over Sharan when the deliverable is a lab, a detection walkthrough or a report-review checklist, or when the audience is analysts who adopt tooling by using it rather than reading strategy.
The content is vendor-agnostic and hands-on, not product-architecture advocacy.
The Sentinel lab uses Microsoft tooling and credits another source; the pentest manual covers report quality and retesting, not security data management.
Neither post discusses federation, data mesh, per-source retention or SIEM data architecture.
A campaign that needs to explain why security data should stay distributed will need Sharan's argument.
The format also asks readers to build or review something, requiring more production work than a thought-leadership post.
Faruque is the better choice when the campaign angle is AI-era threat detection rather than security data architecture.
Read more
The posts cover AI-native attacks: indirect prompt injection against Salesforce Agentforce, the ForcedLeak example, agentic intrusions, AI-accelerated zero-days, and a detection and guardrail stack ranging from delimiter spotlighting and security code review to Lakera Guard, Azure Prompt Shields, behavioral anomaly detection, output filters and monthly automated red teaming against the OWASP LLM Top 10.
They also include panel and event promotion with a free-invite call to action.
For a security analytics vendor positioning its data layer as the foundation for detecting AI-native threats, Faruque supplies the threat narrative and detection use case.
Choose Faruque over Sharan when the campaign is about AI security, prompt injection or detection engineering for AI systems, or needs a current, high-urgency threat topic to anchor the product's value.
The content treats the AI stack as an attack surface and focuses on detection tactics and tooling, not security data architecture, SIEM platforms, federation or data mesh.
The data layer that feeds detections is not the subject.
A campaign built only on this content would explain why AI threats are hard to detect, but not why a federated data mesh is the right architecture for detecting them.
The posts also include event promotion and a call to connect, so the format leans toward community and awareness content rather than a technical architecture argument.
Three LinkedIn posts from Dhiraj Sharan include a first-person account of 25 years in SIEM architecture, a follow-up proposing a Security Data Mesh at Query, and a release post for Query Splunk App 3.1.
The posts establish their sequence but do not include calendar dates.
The posts do not include videos, transcripts, diagrams, or the linked longer release write-up, and they do not discuss other channels.
The profile does not establish performance, cost savings, customer results, job title, ownership, sponsorship terms, or audience composition beyond the follower count shown on the profile.