Blue team and threat hunting

Collecting logs is not the same as detecting attacks

Most companies already send logs somewhere. The hard questions come later: which attacker techniques would those logs show, which rules would fire, and would anyone notice the alert among hundreds of others on a busy day.

This service answers those questions with evidence. We map your log sources against known attacker techniques, test the detections you have, close the gaps that matter most for your business, and leave your team with fewer and better alerts.

When this makes sense

Alerts nobody reads

The platform raises hundreds of alerts a day and the team has stopped looking at most of them.

A new log platform with default rules

Logs are flowing into a new tool, but the detections are still the ones that came in the box.

No idea what the logs cover

Nobody can say which attacks the current logs would show and which would go unseen.

An auditor asks about monitoring

A standard or a customer asks for evidence that security events are watched and acted on.

After an incident nobody noticed

Something happened and was found late, and you want to know why the alerts did not fire.

A small team with too much to watch

A few people cover security among other duties and need fewer, better alerts.

What the engagement covers

Visibility review

We start by listing what you can see today: which machines, servers, cloud accounts and applications send logs, how long the logs are kept and which fields actually arrive.

A map of your log sources against the MITRE ATT&CK techniques they can reveal
Blind spots ranked by how likely an attacker is to use them against you
Concrete settings to turn on, such as process auditing or DNS logging

Detection engineering

We write the detections that are missing and fix the ones that fire too often. Each rule is tested against a safe reproduction of the behavior it is meant to catch before it goes live.

Rules written for your platform, with a description, a severity and the steps to triage
Tuning of noisy rules with exceptions that are documented, not silent
A record of which technique each rule covers, so coverage can be measured

Threat hunting

Alerts only catch what someone thought of before. A hunt starts from a hypothesis, such as a known technique used against your sector, and searches the history for signs of it.

Hypotheses chosen from current threat activity against companies like yours
Every hunt written up: what was searched, what was found and what was ruled out
Anything suspicious handed to incident response the same day

Response playbooks

An alert is only useful if the person who receives it knows what to do next. We write short playbooks for your most important alerts and walk your team through them.

Steps to confirm, contain and escalate, with who owns each step
A tabletop exercise with your team to test a playbook before it is needed

How it works

A first assessment usually takes three to six weeks, depending on how many log sources you have. After that, many teams keep us on a monthly retainer for tuning and hunting.

01

Scoping

We agree on the environments, the log platform and the threats that worry you most, and get read access to the logs.

02

Assessment

We review visibility and existing detections and test them against the techniques that matter for you.

03

Build

We write and tune detections and playbooks with your team, and deploy them in your platform.

04

Hand-over

You receive the report, the coverage map and every rule, and your team is trained to maintain them.

What you receive

Coverage map

Which attacker techniques you can see and detect today, and which you cannot, before and after the work.

Detections and playbooks

Every rule and playbook in your own platform, documented and owned by you.

Report and roadmap

Findings for the technical team, a one-page summary for leadership and a prioritized list of next steps.

Ways to work with us

Both options use the same method. The difference is how long we stay.

Option	Best for	What it includes
Assessment	A first measurement of what you can see and detect	Visibility review, detection tests, new and tuned rules, coverage map and report
Monthly retainer	Keeping detection current as the environment changes	Regular tuning, new detections for new threats, hunts every month and a short monthly report

Questions

Do we need to use the Vorpcel SIEM?

No. We work with the log platform you already have. If you do use Vorpcel, the detections we write go straight into your rule list.

Is this a managed detection service?

No. We do not watch your alerts around the clock. We make your own monitoring better and train your team to run it. If something is found during a hunt, we tell you right away and can start incident response.

What access do you need?

Read access to the logs and to the detection rules. We do not need administrator rights on your machines, and access is removed at the end of the engagement.

How do you measure the result?

By coverage: the number of relevant techniques you could detect before and after, and by the volume of alerts that needed no action before and after tuning.

Which log platforms do you work with?

The common SIEM and log platforms, including the Vorpcel SIEM. Tell us which one you use during scoping and we confirm what we can do inside it.

Can you work alongside our managed security provider?

Yes. We can review the detections they run for you, propose changes and help you ask the right questions about coverage.