Over 160 production-ready skill documents (SKILL.md) for LLM coding agents like Claude Code, Cursor, and Codex.Each skill contains expert-level configs, CLI commands, troubleshooting guides, and ready-to-run scripts spanning six domains: DevOps (CI/CD, Kubernetes, observability), Security (vulnerability scanning, secrets, hardening), Infrastructure (AWS/Azure/GCP, networking, databases, local inference stacks), LLM engineering (agent evals, RAG infrastructure, inference scaling), Compliance (SOC2, HIPAA, GDPR, ISO 27001), and IT operations. Skills install in under a minute via the `npx skills add` CLI or a simple git clone, and the agent discovers, matches, and activates them on demand.
- Ships with notable niche skills absent from other repos: MCP server security, eBPF kernel-level observability, OpenTofu migration, agent-eval CI/CD gates, and multi-tenant LLM hosting with KEDA autoscaling.
- Ships with notable niche skills absent from other repos: MCP server security, eBPF kernel-level observability, OpenTofu migration, agent-eval CI/CD gates, and multi-tenant LLM hosting with KEDA autoscaling.
Anurag Singh replaced five Python scripts (backup, organizer, renamer, cleaner, watchdog) with a local LLM agent, which made errors the scripts didn't (wrong directories, skipped steps, false success reports).Each of the original scripts followed explicit rules through a scheduler; the agent instead added a longer inference chain (inspect, interpret, choose a tool, build a command, execute, review) to tasks that fixed logic already described completely, while also holding a loaded model in memory between runs.
- AutomationBench scores for frontier models remain well under 20%: GPT-5.6 Sol 18.1%, GPT-5.5 12.9%, Claude Opus 4.8 15.5%, Gemini 3.5 Flash 14.5%
- Granting an LLM system-level access creates a prompt-injection vector: a malicious file on disk could carry instructions the agent interprets as commands
- Singh's proposed fix: let the agent classify and route ambiguous requests, then hand off to a validator + fixed script for the actual filesystem action
- The five original scripts covered photo backup, extension-based Downloads sorting, file renaming, app-cache clearing, and a disk-threshold alert
- AutomationBench scores for frontier models remain well under 20%: GPT-5.6 Sol 18.1%, GPT-5.5 12.9%, Claude Opus 4.8 15.5%, Gemini 3.5 Flash 14.5%
- Granting an LLM system-level access creates a prompt-injection vector: a malicious file on disk could carry instructions the agent interprets as commands
- Singh's proposed fix: let the agent classify and route ambiguous requests, then hand off to a validator + fixed script for the actual filesystem action
- The five original scripts covered photo backup, extension-based Downloads sorting, file renaming, app-cache clearing, and a disk-threshold alert
Anurag Singh replaced his home lab cron scripts with Qwen3.5 9B using an agent harness with shell access. He expected contextual reasoning to be superior to rigid automation. The local model succeeded in identifying ballooned directories or judging if a container restart was needed, but it failed more often, sometimes stalling or silently skipping checks.He concluded that deterministic scripts remain the more dependable choice for routine tasks and pointed to n8n as a sensible middle ground when the friction is writing and maintaining code rather than the logic itself.
- A 9-billion-parameter local model needs several GB of RAM just to load weights, which is painful on a home server already running Docker, DNS, and other services.
- Singh's specific hardware ceiling: roughly 14B parameters on a 16 GB MacBook, maybe 32B on an M5 Pro, beyond which you need a dedicated rig.
- His suggested hybrid: let the local model read an error log and draft a short explanation, then have n8n relay that summary without granting the model permission to restart or modify anything.
The model's failure mode was not wrong commands but an inconsistent process—the same prompt and the same system state, yet different execution paths on successive runs.
- A 9-billion-parameter local model needs several GB of RAM just to load weights, which is painful on a home server already running Docker, DNS, and other services.
- Singh's specific hardware ceiling: roughly 14B parameters on a 16 GB MacBook, maybe 32B on an M5 Pro, beyond which you need a dedicated rig.
- His suggested hybrid: let the local model read an error log and draft a short explanation, then have n8n relay that summary without granting the model permission to restart or modify anything.
The model's failure mode was not wrong commands but an inconsistent process—the same prompt and the same system state, yet different execution paths on successive runs.
The article explores a real-world architectural shift where specialized data tools—Redis for caching/pub-sub, Elasticsearch for search, and Kafka for event streaming—were consolidated into a single database engine: PostgreSQL. The primary motivation was to reduce operational complexity, simplify the infrastructure stack, and minimize the cognitive load on developers by managing one unified system instead of several distributed ones.
Summary points:
- Consolidating specialized tools into PostgreSQL reduces overhead in deployment, monitoring, and data synchronization.
- Modern Postgres features like GIN indexes and Full Text Search can effectively substitute for Elasticsearch in many use cases.
- Utilizing Postgres's LISTEN/NOTIFY or simple table structures can replace lightweight pub-sub needs previously handled by Redis or Kafka.
Summary points:
- Consolidating specialized tools into PostgreSQL reduces overhead in deployment, monitoring, and data synchronization.
- Modern Postgres features like GIN indexes and Full Text Search can effectively substitute for Elasticsearch in many use cases.
- Utilizing Postgres's LISTEN/NOTIFY or simple table structures can replace lightweight pub-sub needs previously handled by Redis or Kafka.
This article introduces OpenObserve, an open-source observability platform designed to provide a cost-effective alternative to proprietary services like Datadog. By leveraging cloud object storage such as S3 for storing logs, metrics, and traces, it significantly reduces the financial burden of data retention. Built with Rust for performance, it aims to simplify the observability stack while maintaining high scalability and speed.
- Drastic reduction in costs compared to traditional SaaS monitoring tools
- Unified platform for handling logs, metrics, and traces
- High-performance architecture powered by Rust and object storage integration
- Drastic reduction in costs compared to traditional SaaS monitoring tools
- Unified platform for handling logs, metrics, and traces
- High-performance architecture powered by Rust and object storage integration
Splunk .conf in Denver Sept 2026: The core theme focuses on "Agentic AI"—the transition toward autonomous workflows in security, observability, and operations to manage increasing data complexity and digital risk.
**Sessions**
* **Powering the Rise of the Agentic Enterprise:** Transforming security/ops with scalable, trust-based AI workflows.
* **See Inside Your Agentic AI Applications:** Tracing Python agent interactions to detect hallucinations and tool failures.
* **The Future is Here: What’s New in Splunk Security:** Transitioning to an "Agentic SOC" via automated orchestration.
* **The Platform for Your Agentic Enterprise:** Unlocking cross-domain insights through unified data and AI.
* **What's New in Platform:** Using a unified data fabric for predictive, agentic operations.
* **5 ML Algorithms in Under 5 Lines of Code:** Reducing alert fatigue using simple SPL/MLTK implementations.
* **Accelerate Digital Resilience (Cisco & Splunk):** Maximizing ROI through integrated ecosystem use cases.
* **AI Troubleshooting and Remediation Agents:** Using AI SRE agents to accelerate root cause analysis.
* **Accelerate SmartStore Searches with VAST Data:** Reducing storage costs via InfiniteCache integration.
* **The Cisco & Splunk Partner Playbook:** Strategies for scaling business in the AI era.
* **Accelerating Your Journey to Agentic Observability:** Navigating 4 steps toward agent-driven monitoring.
* **A Compromised Account Alerting System:** Automating detection of suspicious user behavior.
* **Advanced Threat Detection (DSDL & RBA):** Using machine learning for behavioral risk scoring.
* **Advancing Security Operations with ESCU Innovations:** Leveraging new high-fidelity threat intelligence content.
* **Agentic Data Ingestion (Anthropic's Claude):** Automating Splunk Add-On development using GenAI.
* **Agentic Detection Posture Management:** Using AI to rapidly identify and close detection gaps.
* **Agentic Incident Command:** Deploying coordinated AI agent teams for full incident lifecycles.
* **Hands-on Agent Attack Analysis:** Building anomaly detections from raw agent telemetry.
* **Build Your Own SOC AI Agent (Workshop):** Hands-on guide to building custom agents with guardrails.
* **Triage and Response at Scale:** Using Triage and SOP Agents for automated incident response.
* **Agents Are Easy, Trust Is Hard:** Implementing governance in cohesive agentic operations via Cisco Data Fabric.
* **AI Assistant V2 Unlocked (Workshop):** Hands-on with Agent Mode and organizational knowledge integration.
**Sessions**
* **Powering the Rise of the Agentic Enterprise:** Transforming security/ops with scalable, trust-based AI workflows.
* **See Inside Your Agentic AI Applications:** Tracing Python agent interactions to detect hallucinations and tool failures.
* **The Future is Here: What’s New in Splunk Security:** Transitioning to an "Agentic SOC" via automated orchestration.
* **The Platform for Your Agentic Enterprise:** Unlocking cross-domain insights through unified data and AI.
* **What's New in Platform:** Using a unified data fabric for predictive, agentic operations.
* **5 ML Algorithms in Under 5 Lines of Code:** Reducing alert fatigue using simple SPL/MLTK implementations.
* **Accelerate Digital Resilience (Cisco & Splunk):** Maximizing ROI through integrated ecosystem use cases.
* **AI Troubleshooting and Remediation Agents:** Using AI SRE agents to accelerate root cause analysis.
* **Accelerate SmartStore Searches with VAST Data:** Reducing storage costs via InfiniteCache integration.
* **The Cisco & Splunk Partner Playbook:** Strategies for scaling business in the AI era.
* **Accelerating Your Journey to Agentic Observability:** Navigating 4 steps toward agent-driven monitoring.
* **A Compromised Account Alerting System:** Automating detection of suspicious user behavior.
* **Advanced Threat Detection (DSDL & RBA):** Using machine learning for behavioral risk scoring.
* **Advancing Security Operations with ESCU Innovations:** Leveraging new high-fidelity threat intelligence content.
* **Agentic Data Ingestion (Anthropic's Claude):** Automating Splunk Add-On development using GenAI.
* **Agentic Detection Posture Management:** Using AI to rapidly identify and close detection gaps.
* **Agentic Incident Command:** Deploying coordinated AI agent teams for full incident lifecycles.
* **Hands-on Agent Attack Analysis:** Building anomaly detections from raw agent telemetry.
* **Build Your Own SOC AI Agent (Workshop):** Hands-on guide to building custom agents with guardrails.
* **Triage and Response at Scale:** Using Triage and SOP Agents for automated incident response.
* **Agents Are Easy, Trust Is Hard:** Implementing governance in cohesive agentic operations via Cisco Data Fabric.
* **AI Assistant V2 Unlocked (Workshop):** Hands-on with Agent Mode and organizational knowledge integration.
At GrafanaCON 2026, Grafana Labs announced significant updates including the launch of Grafana 13 and a major architectural overhaul for Loki. The new Loki design moves away from replication-at-ingestion toward using Kafka as a durability layer to reduce data duplication and improve query performance. Additionally, the company introduced GCX, a new CLI tool in public preview designed to integrate observability data directly into agentic development environments like Claude Code and Cursor, allowing engineers to resolve production issues without leaving their coding tools.
:
- Loki rearchitected with Kafka to reduce storage overhead and improve query speed.
- Introduction of GCX CLI for seamless observability integration within AI coding agents.
- Launch of Grafana 13 featuring dynamic dashboards and expanded data source support.
- New AI Observability product in public preview for monitoring LLM applications.
:
- Loki rearchitected with Kafka to reduce storage overhead and improve query speed.
- Introduction of GCX CLI for seamless observability integration within AI coding agents.
- Launch of Grafana 13 featuring dynamic dashboards and expanded data source support.
- New AI Observability product in public preview for monitoring LLM applications.
STCLab's SRE team shares their experience building an AI-driven investigation pipeline to automate the triage of Kubernetes alerts. By utilizing HolmesGPT, they implemented a ReAct pattern that allows LLMs to autonomously select tools like Prometheus, Loki, and kubectl based on specific context. The core finding was that high-quality markdown runbooks containing exclusion rules were more critical for successful investigations than the underlying AI model itself.
Key points:
* Implementation of HolmesGPT using the ReAct agent pattern for autonomous troubleshooting.
* Integration with Robusta to manage Slack routing, deduplication, and thread matching.
* The vital role of runbooks in narrowing search spaces and reducing wasted tool calls.
* Comparison between self-hosted models via KubeAI and managed API approaches.
* Significant reduction in manual triage time from 20 minutes to under two minutes per investigation.
Key points:
* Implementation of HolmesGPT using the ReAct agent pattern for autonomous troubleshooting.
* Integration with Robusta to manage Slack routing, deduplication, and thread matching.
* The vital role of runbooks in narrowing search spaces and reducing wasted tool calls.
* Comparison between self-hosted models via KubeAI and managed API approaches.
* Significant reduction in manual triage time from 20 minutes to under two minutes per investigation.
As AI agents evolve from autocomplete tools to active contributors (opening PRs, managing infrastructure), DevOps must adapt. This playbook outlines the shift through these key strategic pillars:
* **Foundational Prerequisites:** Robust CI/CD, automated testing, and Infrastructure as Code are essential for agentic workflows.
* **Evolving Engineering Roles:** Engineers transition from code producers to system designers, agent operators, and quality stewards.
* **Structured Collaboration:** Integration across IDEs, PRs, pipelines, and production environments is required.
* **Repository Design:** Repositories must act as explicit interfaces using skill profiles and instruction files.
* **Development Methodology:** Shift from ephemeral prompt engineering to durable, specification-driven development.
* **Governance & Security:** Implement frameworks for custom agent consistency/auditability and transform CI/CD into active verifiers of semantic intent and security.
* **New Success Metrics:** Move from volume-based productivity counts to outcome-based and trust-boundary measurements.
* **Foundational Prerequisites:** Robust CI/CD, automated testing, and Infrastructure as Code are essential for agentic workflows.
* **Evolving Engineering Roles:** Engineers transition from code producers to system designers, agent operators, and quality stewards.
* **Structured Collaboration:** Integration across IDEs, PRs, pipelines, and production environments is required.
* **Repository Design:** Repositories must act as explicit interfaces using skill profiles and instruction files.
* **Development Methodology:** Shift from ephemeral prompt engineering to durable, specification-driven development.
* **Governance & Security:** Implement frameworks for custom agent consistency/auditability and transform CI/CD into active verifiers of semantic intent and security.
* **New Success Metrics:** Move from volume-based productivity counts to outcome-based and trust-boundary measurements.
Prove AI is developing an observability-first foundation designed for production generative AI systems. Their mission is to enable engineering teams to understand, diagnose, and remediate failures within complex AI pipelines, including LLM inference, retrieval processes, and agent orchestration.
The current release, v0.1, provides an opinionated observability pipeline specifically for generative AI workloads through:
- A containerized, OpenTelemetry-based telemetry pipeline.
- Preconfigured collection of traces, metrics, and logs tailored for AI systems.
- Instrumentation patterns for RAG pipelines, embeddings, LLM inference, and agent-based systems.
- Compatibility with standard backends like Prometheus.
The current release, v0.1, provides an opinionated observability pipeline specifically for generative AI workloads through:
- A containerized, OpenTelemetry-based telemetry pipeline.
- Preconfigured collection of traces, metrics, and logs tailored for AI systems.
- Instrumentation patterns for RAG pipelines, embeddings, LLM inference, and agent-based systems.
- Compatibility with standard backends like Prometheus.
