Vorpsel / Services / Defense and response
Blue team and threat hunting
We work next to your team to make sure an attack in your environment would actually be seen. We check what your logs cover, write and tune the detections that are missing, and hunt for activity that no alert has caught yet.
At a glance
- For teams that collect logs but are not sure what they would catch
- Format a fixed assessment, or a monthly retainer
- Works with the tools you already have, not only Vorpsel
- You keep every detection, query and playbook we write
Collecting logs is not the same as detecting attacks
Most companies already send logs somewhere. The hard questions come later: which attacker techniques would those logs show, which rules would fire, and would anyone notice the alert among hundreds of others on a busy day.
This service answers those questions with evidence. We map your log sources against known attacker techniques, test the detections you have, close the gaps that matter most for your business, and leave your team with fewer and better alerts.
When this makes sense
Alerts nobody reads
The platform raises hundreds of alerts a day and the team has stopped looking at most of them.
A new log platform with default rules
Logs are flowing into a new tool, but the detections are still the ones that came in the box.
No idea what the logs cover
Nobody can say which attacks the current logs would show and which would go unseen.
An auditor asks about monitoring
A standard or a customer asks for evidence that security events are watched and acted on.
After an incident nobody noticed
Something happened and was found late, and you want to know why the alerts did not fire.
A small team with too much to watch
A few people cover security among other duties and need fewer, better alerts.
What the engagement covers
Visibility review
We start by listing what you can see today: which machines, servers, cloud accounts and applications send logs, how long the logs are kept and which fields actually arrive.
- A map of your log sources against the MITRE ATT&CK techniques they can reveal
- Blind spots ranked by how likely an attacker is to use them against you
- Concrete settings to turn on, such as process auditing or DNS logging
Detection engineering
We write the detections that are missing and fix the ones that fire too often. Each rule is tested against a safe reproduction of the behavior it is meant to catch before it goes live.
- Rules written for your platform, with a description, a severity and the steps to triage
- Tuning of noisy rules with exceptions that are documented, not silent
- A record of which technique each rule covers, so coverage can be measured
Threat hunting
Alerts only catch what someone thought of before. A hunt starts from a hypothesis, such as a known technique used against your sector, and searches the history for signs of it.
- Hypotheses chosen from current threat activity against companies like yours
- Every hunt written up: what was searched, what was found and what was ruled out
- Anything suspicious handed to incident response the same day
Response playbooks
An alert is only useful if the person who receives it knows what to do next. We write short playbooks for your most important alerts and walk your team through them.
- Steps to confirm, contain and escalate, with who owns each step
- A tabletop exercise with your team to test a playbook before it is needed
How it works
A first assessment usually takes three to six weeks, depending on how many log sources you have. After that, many teams keep us on a monthly retainer for tuning and hunting.
Scoping
We agree on the environments, the log platform and the threats that worry you most, and get read access to the logs.
Assessment
We review visibility and existing detections and test them against the techniques that matter for you.
Build
We write and tune detections and playbooks with your team, and deploy them in your platform.
Hand-over
You receive the report, the coverage map and every rule, and your team is trained to maintain them.
What you receive
Coverage map
Which attacker techniques you can see and detect today, and which you cannot, before and after the work.
Detections and playbooks
Every rule and playbook in your own platform, documented and owned by you.
Report and roadmap
Findings for the technical team, a one-page summary for leadership and a prioritized list of next steps.
Ways to work with us
Both options use the same method. The difference is how long we stay.
| Option | Best for | What it includes |
|---|---|---|
| Assessment | A first measurement of what you can see and detect | Visibility review, detection tests, new and tuned rules, coverage map and report |
| Monthly retainer | Keeping detection current as the environment changes | Regular tuning, new detections for new threats, hunts every month and a short monthly report |
Questions
Do we need to use the Vorpsel SIEM?
No. We work with the log platform you already have. If you do use Vorpsel, the detections we write go straight into your rule list.
Is this a managed detection service?
No. We do not watch your alerts around the clock. We make your own monitoring better and train your team to run it. If something is found during a hunt, we tell you right away and can start incident response.
What access do you need?
Read access to the logs and to the detection rules. We do not need administrator rights on your machines, and access is removed at the end of the engagement.
How do you measure the result?
By coverage: the number of relevant techniques you could detect before and after, and by the volume of alerts that needed no action before and after tuning.
Which log platforms do you work with?
The common SIEM and log platforms, including the Vorpsel SIEM. Tell us which one you use during scoping and we confirm what we can do inside it.
Can you work alongside our managed security provider?
Yes. We can review the detections they run for you, propose changes and help you ask the right questions about coverage.
Other services
Tell us what you need.
We reply with a few questions about scope, then send a proposal with dates and price.