DETECTION ENGINEERING / SIEM
From log sources to useful detections
End-to-end SIEM deployments and detection use cases for enterprise security operations.
Liquid C2 MENA (formerly SecureMisr) · March 2017 – December 2019
The challenge
Enterprise SIEM deployment, log-source integration, threat hunting, and incident investigation.
My contribution
- Delivered SIEM deployments from log onboarding through use-case development.
- Built detection use cases mapped to MITRE ATT&CK.
- Led threat hunting and incident investigations across enterprise environments.
Illustrative engagement workflow
A simplified explanation of the approach, not a reproduction of client records.
- Confirm telemetry coverage
- Map a detection hypothesis to behavior
- Test against representative events
- Tune and document operational limits
Illustrative deliverables
Examples of work products for this type of engagement; no client artifacts are published.
- Log-source onboarding checklist
- Detection validation record
- Investigation query with stated assumptions
Career outcomes are reported in my CV dated 2026-08-31. They have not been independently audited for this website. The workflow and deliverables shown here are illustrative; no client records or additional measured results are claimed.
Results & outcomes
- 50% improvement in event detection.
- 35% reduction in false positives.
Selected work summarized from my professional experience. Client-sensitive implementation details are not included.