NESQ

Cybersecurity practice

Design SIEM, SOAR and use cases that drive action.

Engineer log sources, detection rules, playbooks and automations to increase coverage and reduce response time.

Collect the right logs, for defined scenarios.

A SIEM generates value when sources are reliable, use cases respond to real risks and alerts trigger a process. SOAR adds orchestration and automations, but requires quality data, permissions, and error handling.

SIEM activities

  • analysis of risk scenarios and necessary sources;
  • onboarding, parsing, normalization and quality control;
  • design of use cases on ransomware, BEC, identity and exfiltration;
  • correlation rules, thresholds, exception lists and tuning;
  • operational and executive dashboards;
  • log retention, access and protection.

SOAR activity

  • automatic enrichment of IPs, domains, hashes and assets;
  • contextual collection from EDR, identity and cloud;
  • opening and updating tickets;
  • playbook with human approval for sensitive actions;
  • handling timeouts, errors and rollbacks;
  • audit of executions and measurement of benefit.

Continuous improvement

NESQ maintains a catalog of use cases with objective, sources, logic, owner, severity and tests. Incidents, threat hunting, Vulnerability Assessment and Red Teams fuel new rules. Metrics include coverage, quality, false positives, and time saved, not just event volume.