Detection engineering and security data lakes
Detection engineering treats detections as code. Each rule has a purpose, a test, a version and an owner, and maps to an attacker technique. A security data lake keeps logs for long periods at low cost so hunters can search months of history.
What we do
- Detection backlog from ATT&CK gaps
- Sigma to KQL and Elastic conversion
- Rule test harness
- Tuning reports
- Hunt queries
- Retention tier design
- Handover documentation
Our team works with Sigma rules, Elastic Security, Microsoft Sentinel with KQL and Google Security Operations, and has experience with Splunk and OpenSearch. We write rules, replay test data, measure false positives and retire rules that do not earn their place.
This group links to our Cybersecurity and Cyber Automation services and to the log pipelines and SOAR groups. These are tools our team has experience with, not partnerships.
Leading platforms we work with
- Sigma
- Elastic Security
- Microsoft Sentinel
- Kusto Query Language (KQL)
- Google Security Operations
- Splunk
- OpenSearch
- MITRE ATT&CK
- Panther
- Snowflake security data lake
Platforms and practices
- Sigma rule authoring and conversion
- Detection as code in version control
- Rule testing with replayed logs
- KQL analytics rules and hunting queries
- Elastic detection rules
- ATT&CK coverage mapping
- False-positive tuning
- Long-term log tiers and data lakes
- Threat hunting notebooks
- Rule retirement review
References
Sources last checked .
Product names are trademarks of their owners and are listed to describe our experience; they do not imply endorsement or partnership.
How we use Detection engineering and security data lakes for clients
Cybersecurity
We find out whether everything you run is safe from attackers, then we fix it.
Learn moreCyber Automation
Custom AI agents that do repetitive work around the clock, with human review where it matters.
Learn moreManaged IT Services
We run your IT day to day so it stays secure: help desk, devices, Microsoft 365, Exchange, Active Directory, backups, networks and monitoring.
Learn moreFrequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageWhat does detection as code mean?
Each detection rule has a purpose, a test, a version in source control and an owner, and maps to an attacker technique. That makes rules reviewable and easy to roll back, and it lets you retire rules that do not earn their place.
Why keep logs in a security data lake?
A data lake stores logs for long periods at low cost, so hunters can search months of history after a new technique is learned. Short retention in a fast, expensive tool often hides slow attacks.
How do you avoid a flood of false alarms?
We replay test data against each rule before it goes live, measure false positives, tune the rule and review it again after deployment. Rules that stay noisy are fixed or removed.
Do we have to use one specific SIEM?
No. Sigma rules are written in a vendor-neutral format and can be converted to KQL or Elastic rules. We work with several platforms, so the rules are not locked to one product.