Guides for security teams that want proof.

All guides

1. G01 · Detection engineering · 9 min read

   MITRE ATT&CK detection coverage: rule exists vs. validated

   How to measure MITRE ATT&CK detection coverage honestly: the four levels from rule exists to validated, the denominator to state, and how to close the gap.

   Finding F01 A rule mapped to a technique proves only that someone wrote it. Coverage that counts must also be enabled, fed by healthy data and validated to fire.

2. G02 · SIEM operations · 8 min read

   SIEM health check: how to find silent log sources and dead rules

   A practical SIEM health check: how to find log sources that went silent, rules that are enabled but never run or fire, and alerts that reach nobody.

   Finding F01 Enabled is not the same as running, running is not the same as producing alerts, and an alert that reaches no queue protects nobody. Each needs its own check.

3. G03 · SIEM strategy · 8 min read

   QRadar on-prem in 2026: your options after the QRadar SaaS sale

   What the QRadar SaaS sale to Palo Alto Networks changed, what it did not, and how to choose between staying on QRadar on-prem, migrating or running a phased move.

   Finding F01 Palo Alto Networks lists end-of-life dates of 14 April 2026 and 31 August 2026 for the QRadar SaaS products it took over.

4. G04 · Regulation · 9 min read

   DORA and NIS2 incident reporting timelines: what your SOC must produce

   The DORA and NIS2 incident reporting clocks (4 hours, 24 hours, 72 hours, one month) and the evidence your SOC must have ready at each step.

   Finding F01 Under DORA, the initial notification of a major ICT-related incident is due within 4 hours of classifying it as major and no later than 24 hours after becoming aware of it.