Operations | Monitoring | ITSM | DevOps | Cloud

Most IT operations teams cannot say how much of the MITRE ATT&CK framework they already cover. The framework gets explained in the language of threat hunting and red teams. The parts that belong to infrastructure work are easy to miss. And then, coverage questions get answered with a guess. The mismatch costs time on both sides. Security asks for a coverage answer that ops has no clean way to produce. Yet the controls that stop a large share of those techniques already sit with your team.

What do you say when an auditor asks for evidence that your security controls hold, and all you can produce is a scan report from last month? A scan lists weaknesses. It says nothing about whether an attacker could chain three of them together and reach the customer database. Vulnerability assessment and penetration testing answer two different questions about the same environment. The first asks what is exposed right now. The second asks what someone with intent and skill could do with that exposure.

Azure Virtual Desktop (AVD) is rapidly growing in popularity as modern way to deliver virtual desktops and apps to users, with Azure providing the infrastructure as alternative to on-prem VDI environments. As organizations expand their use of AVD in Azure, monitoring becomes critical.

Last week, we sat down with the authors of Observability Engineering for a live AMA. We ended up getting so many questions (pre-submitted and live) that we couldn't get through them all. Charity, Liz, George, and Austin kindly stuck around afterward to answer more, ranging from low-hanging observability fruits and telemetry to AI and what software engineers can do that Claude can't. Missed the live session? Watch it on demand now.

At.conf25, we announced our vision for Cisco Data Fabric, an architecture designed to help organizations unlock the value of machine data, fuel AI with trusted context, and support more intelligent and resilient operations. Today, that vision has become reality. Key Splunk Platform innovations including Machine Data Lake, Catalog, and Agent Launchpad, together with expanded Federated Search and Data Management capabilities, are now generally available.

Summary Physical AI—machines and industrial systems that sense conditions, reason, and act in the real world—needs two things from operational data: detailed history for training, and real-time telemetry for inference. Traditional data historians weren’t built for either at the speed Physical AI requires. Four gaps result: limited real-time access, compression that strips model-relevant signal, IT/OT fragmentation, and site-by-site architectures.

We’ve shipped another round of updates to help you get more value from StatusGator. From Bulk Import and monitor dependencies to new Zoom Rooms, Rise Vision, and OptiSigns integrations, here’s what’s new this month.

Netdata AI can now connect outward to the tools your team already runs, like GitHub, PagerDuty, Atlassian, or any custom MCP server, and read from them during an investigation. We call this MCP Connections. It’s the missing piece in the middle of every root-cause investigation: the alert tells you what changed, but the why is usually somewhere else entirely.