Detection engineering
Collecting logs is not the same as detecting attacks. I build and tune the detections that turn your SIEM into something that warns you in time, without drowning your team in noise.
When it makes sense
- You have a SIEM, but it rarely raises a useful alert
- Your team ignores alerts because there are too many false positives
- After an incident, to make sure you would see the same attack next time
- You are moving to Microsoft Sentinel, Splunk or ELK and want to start on the right foot
- You don't know which attacker techniques you can actually detect
How I work
- 01
Visibility review
Which log sources you collect, which ones are missing, and whether the important events are really there.
- 02
Priorities
We pick the techniques that matter most for your environment and your threats, mapped to MITRE ATT&CK.
- 03
Build and test
Detection rules written for your platform, tested with simulated attacker activity, for example with Atomic Red Team.
- 04
Tuning
False positives reduced with your team, so that each alert deserves attention.
- 05
Handover
Every detection documented with its triage steps, so your analysts know what to do when it fires.
What you get
- Detection rules ready to deploy on your SIEM (KQL, SPL or ELK queries)
- A coverage map of the MITRE ATT&CK techniques you can now detect
- A list of visibility gaps and the log sources to add
- Triage notes for each detection
Why Cyber Horizon
- Detections written by someone who investigates real attacks: I know what attackers leave behind
- GIAC Certified Detection Analyst (GCDA) and Intrusion Analyst (GCIA)
- Experience with Microsoft Sentinel, Splunk and ELK
- Threat hunting findings turned into new detections
Frequently asked questions
Which SIEM do you work with?
Mainly Microsoft Sentinel, Splunk and ELK. For other platforms, the logic stays the same and we adapt the query language.
Do you replace our SOC or MDR provider?
No. I build and improve the detections; your SOC, your MDR provider or your IT team keeps handling the alerts.
How many detections should we expect?
It depends on your logs and priorities. I prefer a short list of reliable, tested detections over hundreds of rules nobody looks at.
Can you start from our existing rules?
Yes. Reviewing and tuning what you already have is often the quickest win.