Skip to content
Book a test

home / services / siem / detection

// siem / detection

SIEM setup & monitoring

A pentest finds what's wrong today; a SIEM helps you spot what goes wrong tomorrow. We set up the pipeline, build and tune detections mapped to MITRE ATT&CK, and monitor alerts during business hours.

MITRE ATT&CKSIEMCVSS 3.1 / 4.0

// scope

What's in scope

We scope every engagement in person-days against your real attack surface. Here's what a typical test of this kind covers.

In scope
  • SIEM setup, log pipelines and data onboarding
  • Detection engineering mapped to MITRE ATT&CK
  • Alert monitoring and triage during business hours
  • Cloud, endpoint and network telemetry
  • Alert tuning so you see real incidents, not noise
  • Incident-response playbooks for your team
Out of scope / by agreement
  • 24/7 or out-of-hours monitoring
  • Replacing your existing IT/helpdesk function
  • Physical security monitoring
  • Legal representation during an incident

// method

How we test it

Manual-first, grounded in our five-stage methodology. Scanners cover ground; a person reproduces and proves every finding.

  1. 01

    Onboard

    Connect your log sources and cloud, endpoint and network telemetry into the SIEM.

  2. 02

    Tune

    Build and tune detections mapped to MITRE ATT&CK, cutting false positives before go-live.

  3. 03

    Monitor

    Alerts are watched and triaged in business hours, with escalation to your team.

  4. 04

    Improve

    Periodic posture reports and detection updates as your environment changes.

// deliverables

What you get

A report a developer can act on and a manager can understand — plus a free retest to confirm the fixes.

  • A running SIEM with your telemetry onboarded
  • A detection library mapped to MITRE ATT&CK
  • Business-hours alert triage and escalation
  • Incident-response playbooks
  • Periodic security posture reports

// faq

Common questions

Do we need our own SIEM first?

No. We can deploy one for you, or work on top of one you already run, such as Elastic, Wazuh, Splunk or a cloud-native stack.

Is this 24/7?

No. Monitoring is during business hours. If you need round-the-clock coverage, tell us and we will say plainly whether we can meet it.

Is this offensive or defensive?

Defensive. It complements our offensive work, so findings from a pentest can feed straight into detections.

Set up your SIEM

Share your targets and timeline and we'll reply with a scope and a quote. Most scoping calls take thirty minutes.

Get a quoteSee a sample report