Building a SOC That Actually Detects: Telemetry, Detection Engineering and People

Banks, government entities and operators across the GCC are investing heavily in security operations. The organisations getting value share three characteristics: they know which telemetry they collect and why, they treat detections as engineered artefacts with tests and owners, and they develop analysts systematically.

Telemetry with intent

Map log sources to the attacker techniques you care about (MITRE ATT&CK is the common language) and fill gaps deliberately — endpoint, identity, network, cloud control plane and, for operators, signalling and core network events.

Detection as code

Every detection should have a description, the technique it covers, test data, a tuning history and an owner. Managed in version control, reviewed like software.

Analysts who investigate

Tier-1 triage is being automated. The valuable skill is investigation: reading logs across sources, forming hypotheses, hunting and writing clear incident reports. That is a trainable skill, and it is where SOC training programs should focus.