SIEM Engineering & Detection
A SIEM nobody trusts is worse than no SIEM. It burns analyst time and hides the real signal. I build Wazuh deployments from the ground up, then tune them until the alerts are worth investigating. I've done it for a New York MSSP and for a high-traffic production platform.
- Typical timeline
- 2 to 6 weeks
- Engagement
- Project or monthly retainer
- Deliverable
- Report, PoC evidence and retest
What the work covers.
Architecture & deployment
Manager, indexer and dashboard sizing, agent rollout, high availability and retention. Designed for your log volume, not a lab.
Log ingestion
Endpoints, network devices, cloud services and application logs, with parsing that survives real-world format drift.
Detection content
Custom decoders and correlation rules for the threats you actually care about, plus MITRE ATT&CK coverage where it helps.
File integrity monitoring
FIM for critical paths, including WordPress and web roots, configured to catch change without flooding the queue.
Dashboards & reporting
Operational views for analysts and a monthly report leadership can read, with alert trends and the tuning decisions behind them.
Tuning & triage
False-positive reduction, alert classification, escalation paths and a runbook your team can follow at 3am.
How the engagement runs.
No engagement starts without a written scope and agreed rules of engagement. Testing windows, contacts and escalation paths are fixed before anything is touched.
What I need from you
- Scope: URLs, apps, IP ranges or accounts in scope
- One technical contact and one escalation contact
- A testing window, or written approval to test 24/7
- Credentials for the roles that should be tested
- 01
Scope
A short call, then a written scope. Targets, rules of engagement, testing windows and anything that is out of bounds.
- 02
Test
Manual work against the real attack surface, with automated tooling where it helps. Findings are confirmed before they reach the report.
- 03
Prove
Every issue comes with reproduction steps, a CVSS score and a realistic impact statement. Critical is just a word without evidence.
- 04
Verify
After remediation I retest each finding and confirm it is closed. Most engagements stop before this step. This is the one that counts.
Often paired with
Application & API Penetration Testing
Manual, OWASP-aligned testing of your web app and APIs. Authentication, access control, business logic, and the flaws that only appear when someone actually tries to break in.
Cloud & Infrastructure Security Review
A focused review of the cloud and Linux estate your product sits on. Identity, object storage, network exposure, and the CDN edge in front of it.
Ready to scope this work?
Send a short description of the environment and what you need to know. You will get an honest read on scope, timeline and whether this is the right engagement.
Typically replies within one business day. NDA on request.
enes.ismaili@gmail.com