Security
Cyber Threat Detection Services
Collect the right telemetry, turn it into high-fidelity detections mapped to real attacker behavior and give your team alerts worth investigating.
See Attacks Early, While They Can Still Be Stopped
Prevention eventually fails. A user approves a fraudulent multi-factor prompt, a vendor account is compromised or a new exploit appears before a patch is available. What matters then is how quickly you notice. Attackers typically need time to escalate privileges, move laterally and reach valuable data. Each of those steps leaves traces in identity logs, endpoint telemetry, cloud audit trails and network data, if someone is collecting and watching them.
Hanoi Technology helps you build detection that works. We identify the log sources that matter, onboard them into a SIEM or XDR platform, write and tune detection rules mapped to the MITRE ATT&CK framework, automate enrichment and triage, and establish monitoring and threat hunting routines. The goal is fewer, better alerts, each with the context an analyst needs to act quickly.
The Challenge
Why Threats Go Unnoticed
Detection gaps usually come from data, tuning and process rather than a lack of tools.
Missing or Incomplete Telemetry
Key sources such as identity provider sign-ins, cloud audit logs, EDR data or SaaS activity are not collected, leaving blind spots attackers can use.
Alert Fatigue
Default vendor rules fire constantly on benign activity, and analysts start ignoring alerts, including the real ones.
No Coverage Map
Teams cannot say which attacker techniques they can detect, so gaps are only discovered after an incident.
Slow, Manual Triage
Analysts copy indicators between consoles and look up user and asset details by hand, adding hours to every investigation.
Business Value
What Effective Threat Detection Delivers
Shorter Attacker Dwell Time
Detecting compromise early limits how far attackers can move and how much data they can reach.
Higher-Fidelity Alerts
Tuned rules and correlation reduce false positives so analysts spend time on genuine threats.
Visible Detection Coverage
A MITRE ATT&CK coverage map shows strengths and gaps and guides investment.
Faster Investigations
Automated enrichment with identity, asset and threat intelligence context speeds triage and decisions.
Cloud and SaaS Visibility
Monitoring extends beyond on-premises networks to cloud control planes and business applications.
Better Use of Existing Tools
Many organizations already license capable platforms such as Microsoft Defender XDR or Sentinel but use only part of them.
Detection Is an Engineering Discipline
Mature teams manage detection rules like code: version-controlled, tested against simulated attacks, reviewed for false positives and retired when no longer useful. We bring this detection-as-code approach to your environment so coverage improves steadily rather than depending on vendor defaults.
Our Services
Hanoi Technology’s End-to-End Cyber Threat Detection Services
Services that build and continuously improve your detection capability.
Detection Readiness Assessment
We review your log sources, tools, rules and processes, and map current detection coverage against MITRE ATT&CK and your threat profile.
- Telemetry gap analysis
- ATT&CK coverage map
- Prioritized improvement plan
SIEM and XDR Implementation
We deploy or optimize platforms such as Microsoft Sentinel, Splunk, Elastic Security or Google Security Operations, with data connectors and retention aligned to needs and budget.
- Platform deployment and configuration
- Log source onboarding
- Cost and retention optimization
Detection Engineering
We write, test and tune detection rules for the techniques most relevant to you, using standards such as Sigma where practical, and manage them as code.
- Custom detection rules
- Detection-as-code repository
- Testing with attack simulation
Alert Triage Automation (SOAR)
We build playbooks that enrich alerts, correlate related events and automate safe response actions such as isolating a device or disabling an account.
- Enrichment and triage playbooks
- Automated containment actions
- Case management integration
Threat Hunting
We run hypothesis-driven hunts across your telemetry to find threats that evade existing rules, and convert findings into new detections.
- Hunting hypotheses and queries
- Hunt reports
- New detection rules
Monitoring Support
We support continuous monitoring and triage within agreed hours and escalation paths, as a dedicated team or managed service.
- Monitoring runbooks
- Escalation matrix
- Monthly detection metrics
Our Approach
How We Build Your Detection Capability
We prioritize the threats most likely to affect you and expand coverage iteratively.
- 01
Profile Threats and Assets
We identify crown-jewel assets, likely threat actors and techniques relevant to your industry and technology stack.
Deliverables: Threat profile · Priority technique list
- 02
Close Telemetry Gaps
We onboard and normalize the log sources needed to detect priority techniques, balancing coverage with ingestion cost.
Deliverables: Onboarded log sources · Data normalization
- 03
Engineer and Tune Detections
We build rules, test them with simulated attacks and tune thresholds and exclusions in your environment.
Deliverables: Tested detection rules · Tuning records
- 04
Automate Triage and Response
We create playbooks for enrichment, correlation and safe automated actions, integrated with ticketing and communication tools.
Deliverables: SOAR playbooks · Integrated case workflow
- 05
Measure and Improve
We track metrics such as alert volume, true positive rate and time to triage, and update coverage as threats change.
Deliverables: Detection metrics dashboard · Quarterly coverage review
Use Cases
Threat Detection Use Cases
Examples of detections that protect real organizations.
Account Takeover Detection
Detect impossible travel, anomalous sign-ins, MFA fatigue patterns and suspicious inbox rules in Microsoft 365 or Google Workspace.
Ransomware Early Warning
Identify precursor activity such as credential dumping, disabling of security tools and mass file modifications before encryption spreads.
Cloud Control Plane Monitoring
Alert on risky changes in AWS, Azure or Google Cloud, such as new access keys, disabled logging or public storage.
Insider and Data Exfiltration
Spot unusual downloads, large transfers to personal storage or access to sensitive data outside normal patterns.
Application and API Abuse
Detect credential stuffing, enumeration and abnormal API usage patterns in customer-facing applications.
Third-Party and Supply Chain Activity
Monitor vendor accounts and integrations for actions outside their expected scope.
Technology
Detection Technologies We Work With
We work with leading SIEM, XDR and cloud-native security platforms.
- Microsoft Sentinel
- Microsoft Defender XDR
- Splunk Enterprise Security
- Elastic Security
- Google Security Operations
- CrowdStrike Falcon
- SentinelOne
- Amazon GuardDuty
- AWS Security Hub
- Microsoft Defender for Cloud
- Wazuh
- Sigma
- MITRE ATT&CK
- Atomic Red Team
- Zeek
- Suricata
Platforms
Deliver Cyber Threat Detection on Your Preferred Platform
- Microsoft AzureModernize data, analytics and AI within your Azure tenant.Explore
- AWSBuild, migrate and run data and AI workloads on Amazon Web Services.Explore
- Google CloudBigQuery, Looker and Vertex AI for data-driven organizations.Explore
- MicrosoftPower BI, Power Platform, Fabric and Dynamics 365.Explore
Why Hanoi Technology
Why Organizations Choose Hanoi Technology
Senior, Cross-Functional Teams
Strategy, data, AI, cloud and engineering specialists work as one team, so nothing is lost between hand-offs.
Proven Delivery
More than 50 projects delivered for clients in North America, Europe and Asia-Pacific.
Radical Transparency
A written update every week and a demo of working software every sprint, so you always know where things stand.
Cost-Effective Global Delivery
Experienced engineers from our Hanoi delivery hub, with working-hour overlap for every major time zone.
Success Story · Fintech
All-in-one digital banking app for a traditional bank
A traditional financial institution wanted to compete with neobanks for mobile-first customers. We replaced a set of separate banking, investing and payment apps with one product that people use every day.
Read the Full StoryResources
Featured Resources
Industry trends and practical guidance to help you get more value from data, AI and technology.
FSMA 204 After the Delay: Using Shipment Monitoring to Get Traceability-Ready by 2028
The FDA Food Traceability Rule deadline moved to July 2028, but the data work is large. Here is how to use shipment monitoring and event data to get ready without wasting the extra time.
CSRD After the Omnibus: What the Revised ESRS Mean for Reporting From 2027
The Omnibus and the simplified ESRS reshaped EU sustainability reporting in 2026. Here is who is in scope, what changed in the standards and how to adapt your data and process.
OpenTelemetry in 2026: Building a Vendor-Neutral Observability Strategy
OpenTelemetry has become the default way to collect telemetry. Here is what changed in 2026 and a practical roadmap for a vendor-neutral observability stack.
Turn Your Logs into Early Warning
Tell us about your environment and current tools. We will reply within 24 hours and arrange a free consultation to discuss your detection priorities.
Cyber Threat Detection FAQ
What is the difference between SIEM, EDR and XDR?
A SIEM collects and correlates logs from many sources, such as identity, cloud, network and applications, for detection, investigation and retention. EDR focuses on endpoints, recording process, file and network activity and enabling response actions on devices. XDR combines telemetry from endpoints, email, identity and cloud within one vendor ecosystem for correlated detection. Many organizations use EDR or XDR together with a SIEM to cover sources outside the XDR platform.
Which log sources should we collect first?
Prioritize sources that reveal the most common attack paths: identity provider and sign-in logs, endpoint detection telemetry, email security events, cloud audit logs such as AWS CloudTrail or Azure Activity logs, firewall and VPN logs, and logs from critical business applications. We map each source to the techniques it helps detect and estimate ingestion cost, so you can make informed decisions about coverage.
How do you reduce false positives?
We tune rules to your environment by analyzing what triggers them, adding context such as known administrative accounts or scheduled jobs, adjusting thresholds and correlating multiple weak signals into stronger ones. Every rule is tested against simulated attack activity to confirm it still detects what it should. Tuning decisions are documented in a detection-as-code repository, so they are reviewable and reversible.
How do you use MITRE ATT&CK?
MITRE ATT&CK is a public knowledge base of attacker tactics and techniques. We use it to describe your threat profile, map existing detections to techniques, visualize coverage gaps and prioritize new rules. It also gives analysts a common language during investigations and helps communicate progress to leadership in a structured way. Coverage maps are combined with testing, because a mapped rule is only valuable if it actually fires.
Can you work with the tools we already have?
Yes, and we usually recommend it. Many organizations already license capable platforms through Microsoft 365, their cloud provider or their endpoint vendor. We optimize what you have first, onboarding missing sources and building custom detections, and only recommend new tools when there is a clear gap. We are vendor-neutral and work across Microsoft, Splunk, Elastic, Google, CrowdStrike and open-source tools.
What drives the cost of a detection program?
Major cost drivers include SIEM ingestion and retention volume, the number of log sources and environments, the number of custom detections and playbooks, the monitoring hours required and platform licensing. We help control cost by filtering low-value data, using tiered storage and focusing on high-value sources. Implementation is typically a project, followed by ongoing tuning as a dedicated team or managed service.