Managed Detection Engineering & SOC Enablement
Detection-as-code delivered as an ongoing engineering practice — version-controlled Sigma and platform rules, telemetry onboarding, tuning against real alert data, and the lifecycle that stops detections rotting the moment the environment changes.
Verified Solvex Specialist
Verified by SolvexDirect specialist contact for Solvex engagements
What this means. An authorized Solvex administrator registered and approved this exact public identity. What it does not. Solvex has not inspected the account on the platform, and this is not the platform's own verification.
Solvex specialists never ask for your passwords, recovery phrases, one-time codes, or payments to a personal account. Work, scope and invoices are agreed in writing through the official channels on this site.
What's covered
- Detection-as-code repository, review process and CI validation
- Sigma authoring and translation to your SIEM's native logic
- Telemetry onboarding and normalisation for new log sources
- Alert tuning against observed false-positive data
- Playbook authoring tied to each detection
- Detection lifecycle: authored, tested, deployed, measured, retired
- Coverage engineering against prioritised threats
- Analyst enablement and handover of the practice to your team
What you receive
- Detection repository with version control and CI validation
- Deployed and tuned detection rules with documented intent
- Per-detection playbooks and triage guidance
- Telemetry onboarding documentation
- Coverage report showing what changed and what remains blind
- Enablement sessions so the practice survives without us
Evidence and reporting
How the work is kept honest- Evidence, frozen at issuanceFindings tie to something observed. When the report is issued, the evidence behind it is frozen in the same transaction and cannot be edited afterwards.
- A signed reportAn Ed25519 signature covers both the report content and the delivered file. Alter a byte of either and verification fails.
- Written scope firstAdvisory work runs to a written scope agreed before it starts, so what you receive is what was agreed.
Anyone holding a Solvex report can verify it publicly without seeing its contents.
Our boundaries
What this engagement does not do, stated before it starts.
- Solvex does not provide 24/7 human monitoring under this service — this is engineering, not a watch floor
- Detection capability is bounded by the telemetry available to it
- No detection set catches every technique, and we will not imply one does
- Platform licensing remains your cost and your relationship
How this engagement runs
- 01
Intake
Tell us the system, the goal and the constraints. If the work is not a good fit, we say so before anyone is invoiced.
- 02
Scope and authorization
Written scope and signed authorization before anything is touched. Security testing runs only against systems you own or are contractually entitled to have tested.
- 03
Investigation or build
Specialists matched to the work. Findings are proven by hand — scanner output is a lead, never a finding.
- 04
Evidence
Every finding ties to something observed. When a report is issued, its evidence is frozen in the same transaction, so what backed the report cannot change afterwards.
- 05
Delivery
A signed report: an Ed25519 signature over both the content and the file, with a short verification reference you can read down a phone.
- 06
Verification and retest
Anyone holding the report can verify it publicly without seeing its contents. Fixes are retested as part of the engagement — “fixed” means we confirmed it.
Questions we are asked
- Do you monitor our alerts around the clock?
- No, and we would rather say that plainly than let the word 'managed' imply it. We build, tune and maintain the detections; your team or your MDR provider watches them. If continuous human coverage is what you need, we will help you specify and select it.
- Why detection-as-code?
- Because detections written in a console are invisible, untested and unreviewable. In a repository they get peer review, CI validation, a documented intent, and a history that answers 'why does this rule exist' two years later when it starts firing.
- How do you decide what to detect first?
- By what is both probable against your organisation and observable with telemetry you already have. Chasing an exotic technique you cannot see is theatre; covering credential abuse and persistence with logs already flowing usually delivers more in the first month.
Related services
SOC / Detection
SOC Maturity & Detection Coverage Assessment
An honest measurement of what your monitoring can actually see — telemetry gaps, alert quality, ATT&CK coverage, false-positive burden and triage reality — producing a picture of your true detection surface rather than your intended one.
SOC / Detection
SOC Design & Security Operations Architecture
The operating model for detection and response — telemetry planning, SIEM architecture, alert pipeline, case management, escalation paths and the playbooks that turn an alert into a decision rather than a notification nobody owns.
Defense & MDR
Proactive Threat Hunting
Alerts catch known threats; hunting finds the ones already inside that slipped past. Our hunters proactively search your environment for signs of compromise using hypotheses, intelligence and deep telemetry analysis.