Next-gen SOC on the Elastic Stack
500+ MITRE-mapped detections; 40% faster detection and 52% fewer false positives.
The problem
Logs from 20+ sources in inconsistent schemas made cross-source correlation slow and noisy.
What I built
- A detection stack on Elastic, OpenSearch, Wazuh and QRadar with Logstash, Rsyslog, Filebeat and Vector ingestion
- 500+ Sigma and YARA rules mapped to MITRE ATT&CK, plus ML anomaly scoring
- SOAR playbooks for automated response
The result
Billions of events a day at 99.99% pipeline availability, 40% faster detection, 52% fewer false positives and 30% less alert noise.