Cyber Correlate

Englishالعربية Soon
Under attack?
SIEM · Security information and event management

Every source says something. Correlation is what makes it a sentence.

A SIEM collects events from across the estate, parses them into one schema, correlates them against current attacker behaviour and turns the volume into a short list of incidents your team can actually work through.

A SIEM is only as good as what you feed it and who reads what comes out. We size the sources, build the detection content and either train your analysts or run the queue ourselves.

Source coverage

What goes in, and what it lets you see

Most disappointing SIEM deployments are not a platform problem. They are missing three of the rows below, and nobody noticed because a silent source looks like a quiet network.

Source
What is collected
What it makes detectable
Endpoints and servers
Process creation, logons, service and registry changes, PowerShell and script activity
Malware execution, persistence, living-off-the-land technique abuse
Identity and directory
Authentication, group and policy changes, Kerberos and delegation activity
Credential attacks, privilege escalation, directory abuse
Network and perimeter
Firewall, proxy, VPN, DNS and flow records
Command and control traffic, tunnelling, unexpected egress
Cloud and SaaS
Control plane audit logs, sign-ins, sharing and configuration changes
Token abuse, risky sign-ins, exposure created by a misconfiguration
Databases
Access, query and privilege activity on the systems holding your records
Bulk extraction, out-of-hours access, privilege misuse
Applications
Application and web server logs, transaction and error records
Injection attempts, authorisation bypass, business logic abuse
Security tooling
Alerts and telemetry from EDR, NDR, WAF, email security and DLP
Correlation across tools, and the gaps where one tool alone said nothing

Source health is monitored in its own right. A source that stops sending raises an alert, because silence is a blind spot rather than good news.

The pipeline

From raw events to a decision an analyst can defend

Each stage exists to remove work from the next one. Skip a stage and the cost does not disappear, it lands on your analysts, every shift, forever.

Active collectionPassive captureOne schemaTuned contentNo-code rulesRetention
01
Collect
Events pulled from sources and captured from traffic, actively and passively, so blind spots are visible rather than assumed.
02
Normalise
Every source parsed into one schema, so a login is a login regardless of which vendor wrote the log line.
03
Correlate
Detection content matches sequences of behaviour across sources, not single suspicious lines in isolation.
04
Enrich
Asset value, exposure, topology and vulnerability state decide whether an alert is urgent or merely true.
05
Act
A short queue of incidents with context attached, plus retained history so an investigation can reconstruct the moment.
Use case library

Detections we deploy on day one

A starting library, tuned to your environment during the pilot. New correlation logic is built by selecting events and setting conditions, so detection engineering stays inside your team rather than inside a support ticket.

✓Impossible travel and improbable sign-in sequences
✓Brute force followed by a successful authentication
✓New local administrator created outside change windows
✓Service account used interactively
✓Domain admin logon to a workstation
✓Mass file access or bulk export by one account
✓Disabled or cleared audit logging
✓Suspicious PowerShell and encoded command execution
✓Scheduled task or service created for persistence
✓Credential dumping tool signatures and behaviour
✓Outbound traffic to newly registered domains
✓Data transfer volume anomalies by user and host
✓Security tool disabled or agent stopped reporting
✓Access to a segment an account has never touched
✓Authentication from an internal host to every server in a subnet

Known good behaviour is excluded per rule, by host, account or parameter, so an accepted exception stays accepted instead of being re-litigated every month.

Operating model

You own it, we build it

The platform runs on your premises under your licences. We size the sources, deploy, build the use cases, tune out the noise and train your analysts to extend it.

Learn more →

Operating model

We run the night shift

Your platform or ours, operated by our SOC. You receive incidents with context rather than a console you have nobody to watch.

Managed SOC →

Related

The sources worth adding first

EDR and XDR

Endpoint telemetry is the single highest-value source you can connect.

NDR

Network detections catch what never touched a monitored host.

Threat intelligence

Indicators and rules are what keep correlation content current.

Pilot it on three sources.

Endpoints, identity and perimeter. Two weeks is usually enough to show you what your current logging is not telling you.