CrowdStrike & SIEM Threat Detection Setup
Budget: ₹12,500 – ₹37,500 INR
I have a mature security stack built around CrowdStrike, Google SecOps (Splunk in some environments), Qualys, and a TIP layer that alternates between OpenCTI and MISP. What I need now is hands-on expertise that ties all of these platforms together:
• Craft high-fidelity detection logic inside CrowdStrike and Google SecOps/Splunk, mapping each rule to MITRE ATT&CK and my own use-case catalogue.
• Proactively hunt in both the EDR and SIEM data to validate those detections, surface hidden threats, and document repeatable hunt queries.
• Integrate threat intelligence feeds into the TIP and push the relevant IOCs, TTPs, and context back down to CrowdStrike and the SIEM so automation can enrich alerts in real time.
• Correlate Qualys vulnerability data with endpoint and log telemetry, turning patch gaps into actionable risk-based alerts.
Access will be provided to a lab first, then to production once new rules and integrations clear testing. I value clear documentation: every detection or integration should come with a description, prerequisites, and rollback steps so the SOC can own it long term.
If you have demonstrable experience tuning CrowdStrike, building detections in Splunk or Chronicle, and wiring OpenCTI/MISP to both, I would love to see examples and talk timelines for each milestone.
• Craft high-fidelity detection logic inside CrowdStrike and Google SecOps/Splunk, mapping each rule to MITRE ATT&CK and my own use-case catalogue.
• Proactively hunt in both the EDR and SIEM data to validate those detections, surface hidden threats, and document repeatable hunt queries.
• Integrate threat intelligence feeds into the TIP and push the relevant IOCs, TTPs, and context back down to CrowdStrike and the SIEM so automation can enrich alerts in real time.
• Correlate Qualys vulnerability data with endpoint and log telemetry, turning patch gaps into actionable risk-based alerts.
Access will be provided to a lab first, then to production once new rules and integrations clear testing. I value clear documentation: every detection or integration should come with a description, prerequisites, and rollback steps so the SOC can own it long term.
If you have demonstrable experience tuning CrowdStrike, building detections in Splunk or Chronicle, and wiring OpenCTI/MISP to both, I would love to see examples and talk timelines for each milestone.