Why Your SIEM Is Only as Good as the Events You Collect
A practical way to connect Windows collection policies to detection coverage, verify required fields, and distinguish a quiet environment from missing telemetry.
Remote Event Management: Control Windows Log Collection from SiemCore
How to manage SWF channel and event selection centrally, distinguish requested settings from applied configuration, and verify that the intended events reach SiemCore.
From Beta to Production: Building Detection Rules with Confidence
A practical SiemCore rule-development workflow: verify telemetry, evaluate live matches in Beta, investigate false positives, and release with clear acceptance criteria.
From Alert to Action: How SOC Playbook Automation Works
Understand playbook triggers, conditions, tenant scope, integrations, and notification results—and how to verify what happened when an action fails or is unavailable.
Anatomy of an AI Investigation: One Alert, Start to Finish
Follow one alert, an impossible-travel sign-in followed by a new mailbox rule, through every step of an AI-run investigation: baseline check, enrichment, correlation, ATT&CK mapping, verdict, escalation, and the customer update.
Why Every Tenant Needs Its Own Normal
Shared rule packs and a single global model both break down in multi-tenant SOCs. Here is why each tenant needs its own baseline, and how the Sphere of Normalcy works.
What Goes to the Model: Data Handling in an AI-Run SOC
If AI investigates your alerts, some of your security data reaches a model. Here is what context is sent, to which providers, under what terms, and how on-prem deployments keep it inside your network.
The Unit Economics of an AI-Run Tier-1 for MSSPs
MSSP margins are a staffing equation. An illustrative model of what happens to analyst cost per customer, hiring, and onboarding when AI runs tier-1, with the math laid out so you can plug in your own numbers.
AI for Regulated SOCs: Running the Model On-Prem
Some security data cannot leave the building. How an on-prem AI SOC with a locally hosted model handles data-residency requirements and air-gapped networks, and the tradeoffs to plan for.
Automatic MITRE ATT&CK Mapping: Where It Helps and Where It Falls Short
Mapping incidents to MITRE ATT&CK automatically saves time and gives everyone a shared vocabulary. It also has real limits. An honest look at both, and how to use it well.
The End of Tier-1: What a SOC Looks Like When AI Handles Triage
Tier-1 triage is repetitive, rule-bound, and burns out your best people. Here is what changes when AI takes over the front line of your SOC — and what your analysts do instead.
The MSSP Scaling Playbook: Onboard More Customers Without Hiring More Analysts
MSSP growth usually means hiring ahead of revenue. It does not have to. A practical playbook for scaling customers per analyst with AI-run operations, fast onboarding, and automated customer communication.
You Don't Have to Rip Out Your SIEM: Running an AI SOC Layer on Top of It
Replacing a SIEM is a multi-year project nobody wants. The faster path: keep your Splunk, Sentinel, or QRadar investment and put an AI SOC layer on top that does the triage, investigation, and reporting.