Log Plumber

We compare three things: the sources you think you collect, the sources actually arriving, and the sources you need to catch the techniques that matter, mapped to MITRE ATT&CK. Those three sets almost never agree.

You get a coverage map by ATT&CK technique, a list of silent sources with the date each went quiet, blind spots ranked by risk, and a plan to close them in order.

Security products ship configured not to bother anyone. They log little, keep it briefly, and leave the forensically expensive event classes switched off. We reconfigure them to say something usable:

• Endpoint security / EDR — process, command line, module load and file access events an investigation actually needs.
• Firewall / IPS / IDS — log what's allowed as well as what's blocked, enough fields to follow a session end to end.
• NSM — sensor where the traffic really is; capture session metadata and DNS rather than packet counts.
• Servers, applications, cloud — audit logging, command history, access logs at a usable level.

Two things go with this that almost nobody does. We load test it, so switching on more logging doesn't take down the appliance producing it. And we verify it by attack simulation — we generate the attacker behaviour ourselves and confirm it shows up in your logs.

Correct on paper but silent under attack is still a blind spot.

We don't resell licences, so we have no reason to push you toward the expensive answer. We sort your stack on one principle: open source where the real cost is people and you keep control; commercial where you're buying response time, proprietary intelligence, or somebody else's liability.

You get a layer-by-layer comparison with three-year TCO — staff included, not just licence price — a phased migration path, and a straight list of where open source is the wrong answer, with reasons.