Infrastructure · Security · Engineering
Tell us what you need
Home / Security Assurance / SOC & SIEM monitoring
Security operations
A security operation is a filter. Everything your estate produces goes in one end, and what comes out should be a small number of things a person needs to act on. Ours is built on Wazuh, with detections written for your environment and mapped so you can see what is covered.
Figures are indicative of a mid-size estate. Yours will differ; the shape will not.
Open source. No per-endpoint licence, and no vendor able to reprice you at renewal.
Custom rules and decoders, not a stock ruleset applied to everyone.
Each detection tagged, so what is covered and what is not are both visible.
Continuous monitoring, engineer on call. Staffed 24x7 scoped separately.
Four ways in
Few organisations arrive with nothing, and few arrive with something that works. Most are somewhere in between, and the engagement begins wherever that is.
Four entry points, one destination. Most clients join at 01 or 04.
We have designed and built security operations for a national contractor’s estate and for a data centre network build. Both are available as references on request.
Coverage
| Signal | What is collected | What it catches |
|---|---|---|
| Privileged access | Administrative logins, privilege escalation, sudo use, changes to admin groups, out-of-hours access. | Credential misuse before it becomes movement |
| Directory activity | Account creation and deletion, group membership changes, password resets, failed authentication patterns. | Accounts created quietly and used later |
| File integrity | Changes to system binaries, configuration files, web roots and scheduled tasks. | Persistence, and web shells dropped after entry |
| Endpoint behaviour | Process execution, unusual parent-child relationships, script interpreters spawned by office applications. | The first stage of most phishing outcomes |
| Network edge | Firewall accepts and denies, VPN sessions, connections to known-bad destinations. | Exfiltration paths and command traffic |
| Cloud accounts | Console logins, API key use, permission changes, resources created in unexpected regions. | Compromised keys, and cryptomining |
| Platform & hypervisor | Management interface access, virtual machine lifecycle events, configuration change on hosts. | Action against the platform rather than a guest |
The part most providers cannot show you
Every detection we write is tagged with the MITRE ATT&CK technique it addresses. That turns a ruleset from a list into a map — and makes the gaps as visible as the coverage, which is the more useful half.
Illustrative. Your matrix is produced during assessment and updated as detections are written.
Anyone can say they monitor your estate.Rather fewer can show you what they do not watch.
What you receive
| Deliverable | What it contains | What changes |
|---|---|---|
| Assessment report | What is collected today, what is detected, what would be missed, and the coverage map against ATT&CK. | You know where the gaps are |
| Architecture & design | Collection points, sizing, retention, detection set and escalation path, written against your estate and budget. | A security operation you could build without us |
| Deployed platform | Wazuh, agents, dashboards, custom rules and decoders, tuned over an agreed period. | Alerts that are read rather than dismissed |
| Response runbook | What happens on each alert class, who is contacted, what containment is pre-authorised, and what is preserved before remediation. | Nobody negotiates scope during an incident |
| Log retention | Collection, indexing and retention scoped to your requirement and searchable for investigation and audit. | You can answer a question about last quarter |
| Monthly reporting | What fired, what was actioned, what was tuned out and why, and how coverage moved. | A security operation you can report upward |
Scope
Automated orchestration and response needs commercial tooling we have not deployed. Triage and response here involve a person. If your requirement depends on SOAR, we will say so at scoping rather than build around the gap.
We use the intelligence built into the platform and the rules we write. Paid feeds and threat hunting as a discipline are not part of this service today.
The default is continuous automated monitoring with an engineer on call. A staffed console is a different service, scoped and priced as one. We will not describe the first as the second.
These are stated because they are the three questions a security-literate buyer asks in the first call.
Questions
Start here
A failed audit, a client questionnaire, an incident, or a board question. The reason shapes the scope more than the estate does — and if you already have something working, the honest answer may be that you need tuning rather than a project.
An engineer replies within two business days.