Start from threats, not logs
Many SIEM projects begin by ingesting everything and hoping detections emerge. They end with high licence costs and alert fatigue. Start instead from the attacks you most need to catch, then collect the data those detections require.
Day-one use cases
Identity
- Impossible travel and logins from unusual locations
- Brute force followed by a successful login
- MFA fatigue — repeated push prompts
- New privileged role assignments and changes to admin groups
Endpoint
- Ransomware behaviour: mass file modification, shadow copy deletion
- Credential dumping tools and suspicious process chains
- Endpoint protection disabled or tampered with
Network and perimeter
- Connections to known malicious infrastructure
- Exploitation attempts against internet-facing services
- Unusual outbound data volumes
Cloud
- Audit logging disabled
- Storage made public
- Access keys created for privileged identities
Log sources to prioritise
- Identity provider and directory logs
- Endpoint detection and response telemetry
- Firewall, VPN and proxy logs
- Cloud control-plane audit logs
- Email security logs
Retain logs in line with regulatory needs — in India, CERT-In's 180-day requirement is the baseline.
Keep alert quality high
- Document every use case: purpose, data, logic, response steps and owner
- Measure true-positive rate and tune or retire noisy rules
- Map detections to MITRE ATT&CK to see coverage gaps
- Review use cases quarterly as the environment changes
Where SOAR helps
Automation pays off for repetitive, well-understood work: enriching alerts, resetting compromised accounts, isolating endpoints and opening tickets. Automate the evidence gathering; keep humans on the decisions.
Key takeaways
- Build detections from the threats you must catch, then collect the data they need.
- Prioritise identity, endpoint, perimeter and cloud control-plane logs.
- Measure alert quality and automate enrichment with SOAR.
Frequently asked questions
How many use cases should a new SOC start with?
A focused set of high-value detections that the team can investigate well is better than hundreds of noisy rules. Expand as coverage and tuning mature.
Why map detections to MITRE ATT&CK?
It shows which adversary techniques you can detect and where the gaps are, giving a structured roadmap for new use cases.
Should we build or outsource the SOC?
It depends on scale and skills. Many organisations use a managed or co-managed SOC for 24×7 coverage while keeping detection ownership in-house.
A SOC is measured by how fast it turns an alert into a contained incident.
Our cyber security services include SIEM engineering, SOAR playbooks and 24×7 monitoring.
