SCNET · Enterprise IT · Ankara, Türkiye
Security operations are measured by the real incidents closed, not by the alerts on screen. Sanal Çekirdek builds to that measure: which sources are collected, which rules are written, which incident reaches whom.
Collecting everything is the most expensive way to see nothing. Source selection determines detection quality directly.
Every log collected is both cost and noise. Sources are chosen by which detection scenario they feed; a source serving no scenario is not collected. Identity, endpoint and network layers usually take the first three places.
Out-of-the-box rule sets are a starting point, not a destination. Rules are tuned to your own behavior; a rule with high false positives gets narrowed rather than switched off. Every rule carries an owner and a response step.
How an alert becomes an incident and reaches the right person is defined as a flow. Who triages, when it escalates, at what threshold your own team steps in — all written before the incident. A flow learned during a crisis is not a flow.
The operation itself is measured: how many alerts arrived, how many became incidents, how many were real, how long closure took. Those four numbers show whether the setup is working.
Incident volume and team continuity decide. An in-house build gives context but demands shift coverage; buying solves continuity but requires that context be transferred deliberately.
Work backwards from the scenario. Whatever log the sentence 'I want to see this attack' requires is what gets collected; a source with no scenario produces nothing but cost and noise.
By narrowing rules, not disabling them. As normal behavior becomes known, a rule gains context; a disabled rule leaves an attack surface nobody is watching.
Tell us which attack scenarios you want to see; we will work out which sources that needs and how the rules should be built.
Discuss your detection scenariosWe run basic measurement — visits, referring source and page performance — on our own infrastructure in Türkiye; this needs no consent. Advanced measurement, such as form usage and on-page interaction, is processed only with your consent. Declining does not affect your use of the site.
