Microsoft Defender, Purview DLP, Sentinel and Splunk engineering for small businesses

Detection Engineering & Alert Tuning (Defender, Sentinel or Splunk)

Microsoft Defender / Sentinel (KQL)
£1,200.00
Skip to product information
Microsoft Defender, Purview DLP, Sentinel and Splunk engineering for small businesses
  • Microsoft Defender, Purview DLP, Sentinel and Splunk engineering for small businesses
  • Microsoft Defender, Purview DLP, Sentinel and Splunk engineering for small businesses
Detection Engineering & Alert Tuning (Defender, Sentinel or Splunk)

Detection Engineering & Alert Tuning (Defender, Sentinel or Splunk)

£1,200.00
Platform

Make your security alerts worth reading. I'll tune the noisy ones and build detections that catch real threats, using the same approach I use on the Defender and Splunk Enterprise Security platforms I own for a major UK bank.

What's included

  • Review of your current custom detections, analytics rules or correlation searches and their alert volumes
  • Tuning of the noisiest rules to cut false positives
  • Up to 5 new custom detections written in KQL or SPL
  • Check of log sources for gaps in what you're collecting
  • Handover document with each detection explained

Who it's for

Businesses already running Microsoft Defender XDR, Microsoft Sentinel or Splunk Enterprise Security.

You may also like