Build & Respond

Detection engineering

Turn the SIEM and EDR you already own into detections that fire on the attacks that matter to your business, with an evidence trail behind every alert.

Book a strategy call
Ali Aleali

Ali Aleali, CISSP, CCSP

Co-Founder & Principal Consultant

Former security architect for Bank of Canada and Payments Canada. CISSP, CCSP, more than twenty years in enterprise security. Leads every engagement.

Connect on LinkedIn

What the engagement covers

Coverage first, then use cases, then the triage process that turns an alert into evidence.

icon-5

Log coverage map

Which components and connections send logs to the central facility, which do not, and what each control's telemetry looks like when it arrives.

icon-7

Detection use cases from the threat model

Use cases written for the risks your architecture accepts and the attacks that matter to your business, on top of vendor defaults.

icon-3

Tuning and false-positive reduction

Detections tuned against your environment so the queue is one a small team can work.

icon-6

Triage and case process

A case for every alert that warrants investigation, with the outcome recorded. The auditor does not want zero alerts. They want to see someone investigated them.

icon-2

Escalation and response hooks

Who is called, on what, and what the first hour looks like. Connected to your incident response plan or retainer.

icon-9

Evidence for the audit

Monitoring and response evidence produced by the case process, mapped to SOC 2 CC7 and ISO 27001 logging controls.

Assess, Build, Operate, applied to detection

We build on the tools you own. A documented methodology, led by a senior architect with more than ten years of enterprise security experience and a CISSP.

01

Assess

Log sources against the architecture. Gaps closed so the detections have something to see.

02

Build

Use cases from the threat model, tuned against your traffic until the queue is workable.

03

Operate

Triage process, case records, escalation paths and a review cadence handed to your team, or carried inside a fractional security team engagement.

What you hold at the end

Detection that fires on what matters, a queue a small team can work, and the evidence trail behind every alert.

Book a strategy call

  • Log coverage map against the architecture

  • Detection use case library tied to the threat model

  • Tuning records and false-positive baseline

  • Triage and case procedure

  • Escalation runbook

  • Monitoring evidence mapped to SOC 2 CC7 and ISO 27001

What changes

Alerts become cases, cases become evidence, and coverage is a map.

You know what is covered

Which systems ship logs and which detections watch them, written against the architecture.

Detections match your threats

Use cases for the attacks that would hurt your business, not only the vendor's defaults.

Triage leaves a record

Every alert worth investigating becomes a case with an outcome, which is what auditors and incident responders both need.

A queue a small team can work

Tuned so that the on-call person can keep up.

When detection engineering is the right call, and when it is not

We build on the tools you own. If you have no log sources yet, the engagement starts with getting them to a central facility.

Right call when

  • A SIEM or EDR is deployed and alerts are cleared without documented triage

  • A current list of which systems ship logs and where the coverage stops

  • Detections are vendor defaults with no tie to your threat model or your architecture

  • SOC 2 CC7.2 and CC7.3 or ISO 27001 logging and monitoring controls are being tested

Wrong call when

  • You want a 24/7 security operations centre staffed by us; managed detection and response is a separate offer in preparation

  • You need a SIEM vendor migration executed; use the vendor's services and we design the use cases

  • No one internally will own triage once the detections fire

Frequently asked questions

A SIEM collects and correlates. Detection is the set of use cases that decide what an alert means, tuned to your environment, and the triage process that decides what happens next. In our experience the tool is deployed, the defaults are on, and the alerts are cleared without investigation, which leaves monitoring evidence and no response evidence.

Not a clean dashboard. SOC 2 CC7.2 and CC7.3 expect that anomalies are detected and that detected events are evaluated and responded to. Auditors look for cases: an alert, an investigation, an outcome and a rationale, even when the conclusion is a false positive.

Not under this engagement. Detection engineering builds the coverage, the use cases and the triage process, and hands them to your team or carries them inside a fractional security team engagement. A managed detection and response offer operated on your own stack is in preparation.

We build on the tools you already own and are independent of every vendor. Where a product change is warranted, we say so and the vendor's engineers execute it.

From your threat model and your architecture: the risks the design accepts, the connections that matter, and the attacks that would hurt your business. Vendor defaults stay on as a baseline. The use cases we write are the ones a default cannot know about.

Talk to the architect who would do the work

A 30-minute call. We look at your environment and say plainly whether we can help and what it would take.

Book a strategy call

From the blog: monitoring and detection

Stock photo by Yan Krukau via Pexels, illustrating cybersecurity leadership team meeting office (temporary placeholder pending custom hero design).

vCISO Services for Mid-Market SaaS: How to Evaluate Fractional Security Leadership in 2026

vCISO services give a mid-market SaaS company senior security leadership on a fractional basis: someone who owns the security program, drives SOC 2 ...

Learn More
Stock photo by CDC via Pexels, illustrating security operations center team (temporary placeholder pending custom hero design).

Top 8 vCISO Services for Mid-Market SaaS in 2026

The right vCISO service for a mid-market SaaS company is the one that owns and runs the security program end to end, on a fractional basis, the way a ...

Learn More
Architectural blueprint and floor plan, representing security requirements sourced from a system design

What a Security Architect Actually Does: Three Roles and Where Requirements Come From

A security architect does three jobs: sets security requirements for systems other people design, assesses and reviews those designs, and solutions ...

Learn More