Security Operations Cluster Services
Security tooling you cannot query under load is security tooling nobody uses. Indexing and retention are capacity problems before they are policy problems.
What this usually looks like
Logs are collected for compliance, the SIEM is too slow to investigate with, and the hardening baseline was applied once and has drifted ever since.
- A query over a quarter of data does not return before the analyst gives up.
- Retention was set by available disk rather than by a requirement anyone wrote down.
- Detection rules produce so many false positives that real alerts are lost in the noise.
- Nobody can produce evidence of the current compliance posture without a manual sweep.
Three ways to buy this
Audit if you want to know how bad it is. Build if you have the team and want the capability. Managed if you don't want to own the pager. Most engagements start with the audit and decide afterwards.
Audit
A fixed-price health check — the cheapest way in
- Log source coverage and retention requirement mapping
- Query performance baseline at realistic windows, measured
- Detection rule review with false-positive analysis on real data
- Hardening baseline assessment against a chosen framework (CIS Level 1/2)
Build
One-off delivery: design, code, hardening, handover
- Indexer cluster sized for query performance rather than raw ingest
- Tiered storage so recent data is fast and older data stays queryable
- Ingestion pipeline with backpressure handling — a log storm must not lose data
- Detection rules tuned to the environment, with ownership per rule
- Continuous compliance scanning that produces evidence as an artefact
Managed
Build plus 7×24 on-call, SLA and quarterly drills
- Log source health monitored — silence from a source is an alert, not an absence
- Retention and index lifecycle maintained against the requirement
- Detection rule tuning on a cycle, with metrics on alert quality
- Monthly evidence pack: scans, findings, remediation status
- Query performance and ingest headroom reviewed quarterly
What we actually deploy
Specific tooling, not categories. If a version matters to your decision, ask — we will tell you which one we would pick and why, including when the answer is the older one.
SIEM & analytics
- Wazuh (managers + indexer)
- OpenSearch
- Elastic Security
- Splunk (coordination)
- detection rules + tuning
Network detection
- Suricata
- Zeek
- Snort
- tap / span / mirror ports
- PCAP retention tier
Endpoint & host
- osquery
- auditd
- Falco (containers)
- Wazuh agents
- Fleet
Vulnerability management
- Nessus
- OpenVAS / Greenbone
- Trivy
- scan scheduling and deduplication
Hardening & compliance
- OpenSCAP
- CIS benchmarks
- Lynis
- AIDE
- evidence collection automation
Access & isolation
- Teleport / bastion cluster
- session recording
- network segmentation
- Cilium policy
What we will be measured on
These are the numbers we put in the delivery report. If we cannot measure it, we do not promise it.
- A query over the required retention window returns within an agreed time, measured.
- Retention is set by a documented requirement, and the storage design meets it with headroom.
- Every detection rule has a named owner and a measured false-positive rate.
- A log storm test does not lose data — the pipeline applies backpressure instead.
- Compliance evidence is produced as a repeatable artefact, not a quarterly manual project.
What we would build, and where the weak point is
The ingest tier is where security platforms fail quietly: it is the component under load exactly when something interesting is happening. If a log storm can drop data, it will drop data on the worst day of the year.
marks a single point of failure we would raise with you rather than hide. Every architecture has one; the question is whether you know where it is.
What we don't do
Every vendor says yes to everything. Here is where our answer is no, or where someone else needs to be in the room. If this list looks wrong for your situation, tell us — we would rather argue about scope before the contract than after.
- Out of scope
Managed detection and response (24×7 SOC analyst coverage)
We build and operate the platform that analysts use. Staffing a SOC with human analysts is a different service, and we will refer you rather than pretend.
- Requires partner
Penetration testing and red team engagements
We will prepare and harden the environment and act on findings. Offensive testing is delivered by specialist firms we can introduce.
- Out of scope
Legal, regulatory and breach-notification obligations
We produce the technical evidence. What you must report, to whom, and when is a legal question.
- Out of scope
Commercial SIEM licence procurement and volume negotiation
We will model ingest volume and cost for the options. The licence contract is between you and the vendor.
What it looked like last time
A healthcare provider network whose log platform could not answer a query over a quarter of data: indexer cluster resized around query performance rather than ingest volume, tiered storage with requirement-driven retention, detection rules tuned against the environment, and an ingest pipeline that survives a log storm without dropping data.
Anonymised under NDA. No client names, no logos, no invented metrics. Full case library on the work page.
Talk to the security infrastructure engineer about your security operations clusters
Send us the architecture, or just describe what broke most recently. You'll get an engineer's answer, not a discovery questionnaire.
Talk to a security infrastructure engineer: botonwa@gmail.com · +86 130 5181 3099