Build & Respond

Detection engineering

Turn the SIEM and EDR you already own into detections that fire on the attacks that matter to your business, with an evidence trail behind every alert.

Talk to a detection engineer

Share what you need and a consultant will follow up to book a call.

What the engagement covers

Coverage first, then use cases, then the triage process that turns an alert into evidence.

icon-5

Log coverage map

Which components and connections send logs to the central facility, which do not, and what each control's telemetry looks like when it arrives.

icon-7

Detection use cases from the threat model

Use cases written for the risks your architecture accepts and the attacks that matter to your business, on top of vendor defaults.

icon-3

Tuning and false-positive reduction

Detections tuned against your environment so the queue is one a small team can work.

icon-6

Triage and case process

A case for every alert that warrants investigation, with the outcome recorded. The auditor does not want zero alerts. They want to see someone investigated them.

icon-2

Escalation and response hooks

Who is called, on what, and what the first hour looks like. Connected to your incident response plan or retainer.

icon-9

Evidence for the audit

Monitoring and response evidence produced by the case process, mapped to SOC 2 CC7 and ISO 27001 logging controls.

Assess, Build, Operate, applied to detection

We build on the tools you own. A documented methodology, led by a senior architect with more than ten years of enterprise security experience and a CISSP.

01

Assess

Log sources against the architecture. Gaps closed so the detections have something to see.

02

Build

Use cases from the threat model, tuned against your traffic until the queue is workable.

03

Operate

Triage process, case records, escalation paths and a review cadence handed to your team, or carried inside a fractional security team engagement.

What you hold at the end

Detection that fires on what matters, a queue a small team can work, and the evidence trail behind every alert.

Book a strategy call

  • Log coverage map against the architecture

  • Detection use case library tied to the threat model

  • Tuning records and false-positive baseline

  • Triage and case procedure

  • Escalation runbook

  • Monitoring evidence mapped to SOC 2 CC7 and ISO 27001

What changes

Alerts become cases, cases become evidence, and coverage is a map.

You know what is covered

Which systems ship logs and which detections watch them, written against the architecture.

Detections match your threats

Use cases for the attacks that would hurt your business, not only the vendor's defaults.

Triage leaves a record

Every alert worth investigating becomes a case with an outcome, which is what auditors and incident responders both need.

A queue a small team can work

Tuned so that the on-call person can keep up.

When detection engineering is the right call, and when it is not

We build on the tools you own. If you have no log sources yet, the engagement starts with getting them to a central facility.

Right call when

  • A SIEM or EDR is deployed and alerts are cleared without documented triage

  • A current list of which systems ship logs and where the coverage stops

  • Detections are vendor defaults with no tie to your threat model or your architecture

  • SOC 2 CC7.2 and CC7.3 or ISO 27001 logging and monitoring controls are being tested

Wrong call when

  • You want a 24/7 security operations centre staffed by us; managed detection and response is a separate offer in preparation

  • You need a SIEM vendor migration executed; use the vendor's services and we design the use cases

  • No one internally will own triage once the detections fire

Frequently asked questions

A SIEM collects and correlates. Detection is the set of use cases that decide what an alert means, tuned to your environment, and the triage process that decides what happens next. In our experience the tool is deployed, the defaults are on, and the alerts are cleared without investigation, which leaves monitoring evidence and no response evidence.

Not a clean dashboard. SOC 2 CC7.2 and CC7.3 expect that anomalies are detected and that detected events are evaluated and responded to. Auditors look for cases: an alert, an investigation, an outcome and a rationale, even when the conclusion is a false positive.

Not under this engagement. Detection engineering builds the coverage, the use cases and the triage process, and hands them to your team or carries them inside a fractional security team engagement. A managed detection and response offer operated on your own stack is in preparation.

We build on the tools you already own and are independent of every vendor. Where a product change is warranted, we recommend it and the vendor's engineers execute it.

From your threat model and your architecture: the risks the design accepts, the connections that matter, and the attacks that would hurt your business. Vendor defaults stay on as a baseline. The use cases we write are the ones a default cannot know about.

Talk to the architect who would do the work

A 30-minute call. We look at your environment and say plainly whether we can help and what it would take.

From the blog: monitoring and detection

Stock photo by Samon Yu via Pexels, illustrating security operations center monitoring screens (temporary placeholder pending custom hero design).

ISO 27001 A.8.16: Monitoring Activities

ISO 27001 A.8.16 requires that networks, systems, and applications are monitored for anomalous behavior and that potential security incidents are ...

Learn More
Stock photo by Tima Miroshnichenko via Pexels, illustrating log data monitoring dashboard screen (temporary placeholder pending custom hero design).

ISO 27001 A.8.15: Logging

ISO 27001 A.8.15 requires an organization to produce, store, protect, and review logs that record activities, exceptions, faults, and security ...

Learn More
Stock photo by panumas nikhomkhai via Pexels, illustrating data center disaster recovery (temporary placeholder pending custom hero design).

EDR vs MDR: The Simple Difference, and Which One You Need

EDR and MDR sound almost identical, and the two terms often get used interchangeably. The short explanation: EDR is the tool, and MDR is the service ...

Learn More