Invisible data
Telemetry reaches Elasticsearch but never appears in the analyst workflows that depend on it.
Requires attention
Elastic Security · SIEM · Platform Reliability
Make sure your SIEM is actually seeing what matters.
I help security teams improve the health, visibility, and reliability of their Elastic Security environments—from ingestion and Fleet to datastreams, Data Views, architecture, and automation.
PLATFORM_HEALTH LIVE SIGNAL
Visibility score84%
84
Active datastreams127+ 4
Data View coverage91%12 gaps
Healthy agents96%stable
Signal coverageLast 24h
!
Visibility gap detected3 datastreams not covered by active Data Views
HIGHElastic SecuritySIEMFleetECSAWSPythonSecurity & SOAR Automation
The hidden problem
Your SIEM can be running—and still have blind spots.
Security platforms grow over time. Integrations are added, policies change, agents disappear, and operational gaps become harder to see.
Degraded agents
Offline agents, policy drift, and version inconsistencies quietly reduce coverage over time.
Requires attention
Operational debt
Manual checks, unclear ownership, and lifecycle issues turn routine work into recurring incidents.
Requires attention
I identify these gaps and turn them into a prioritized, evidence-backed remediation plan.
Primary service
Elastic Security
Health Check
An independent technical assessment focused on platform health, data visibility, operational gaps, and opportunities for improvement.
01
Data ingestion
- Elastic integrations
- Datastreams & pipelines
- Failed ingestion
- Data source coverage
02
Fleet & agents
- Agent health
- Policies & integrations
- Version consistency
- Deployment issues
03
Data visibility
- Data Views
- Discover coverage
- Namespaces
- Analyst accessibility
04
Architecture
- ECS consistency
- Data lifecycle
- Retention strategy
- Naming standards
- Parsing
- Enrichment
- Logstash
- Kibana
- Beats
05
Operations
- Health indicators
- Operational monitoring
- Configuration gaps
- Automation opportunities
HighExample finding · ES-DV-004
Data visibility!
Datastreams not covered by active Data Views
Observation
Multiple active datastreams contain security-relevant data but are not included in the Data Views used by analysts.
Potential impact
Data may be ingested successfully while remaining difficult or impossible to discover through standard workflows.
Recommendation
Extend existing patterns or create dedicated Data Views for the affected datasets.
What you receive
Clear findings.
Prioritized actions.
Actionable results—not a loose list of technical observations.
Technical assessment
Issues, affected components, impact, evidence, and recommended remediation.
↗Executive summary
A concise overview of the most important findings for technical leadership.
↗Prioritized findings
Every issue classified as Critical, High, Medium, or Low by operational impact.
↗Remediation roadmap
A practical sequence of improvements, starting with the highest-value fixes.
↗Results review
A working session to review evidence, answer questions, and align on next steps.
↗Additional services
Engineering beyond
the assessment.
Elastic Security Engineering
Hands-on engineering and troubleshooting for Elastic Security environments.
Fleet architectureAgent deploymentIntegrationsDatastreamsData ViewsECSLifecycleMonitoring
Discuss an Elastic project ↗Security & SOAR Automation
Reduce repetitive Security and IT work through practical automation and workflow orchestration.
I design automation ranging from individual scripts and API integrations to complete SOAR workflows that collect and enrich signals, apply decision logic, orchestrate multiple systems, and automate operational actions.
$ soar.run --workflow fraud-triage✓ signal enriched✓ analyst validation received✓ response action triggered_
SOAR · Python · PowerShell · Bash · REST APIs · Webhooks · Interactive Messaging
Discuss an automation project ↗Examples include
Automation built around real operational decisions.
- Security orchestration and automated response workflows
- Fraud investigation and triage workflows
- Identity and access management (IAM) data enrichment
- Endpoint telemetry and response integrations
- Signal enrichment and automated decision logic
- Interactive messaging applications for analyst validation and response
- Multi-system API orchestration
- Automated user and endpoint actions
- Platform health checks
- Automated audits
- Data validation and configuration checks
- Automated reporting and operational monitoring
Beyond traditional SOC automation
Automation does not have to stop at cybersecurity alerts.
I have designed a SOAR-based fraud investigation workflow that combined signals and context from multiple security and enterprise systems, including identity and access management platforms, endpoint security telemetry, internal APIs, and interactive collaboration applications.
The workflow enriched incoming signals with additional identity and endpoint context, applied automated decision logic, and used interactive messaging to involve analysts or other stakeholders when human validation was required.
Based on the collected context and response, the workflow could continue through different branches and trigger the appropriate automated actions across integrated systems.
Signal→Enrichment→Decision→Human Validation→Response→Action
Open source / Labs
See how I work.
Tools, experiments, and automation focused on SIEM operations and platform engineering.
01↗02↗03↗
Elastic Data Visibility Auditor
Finds active Elastic datastreams that may not be covered by existing Data Views.
Python · Elasticsearch API · Kibana APIFleet Health Reporter
Collects and analyzes Elastic Agent and Fleet health information automatically.
Python · Fleet API · Elastic SecuritySecurity Platform Automation
Focused experiments that remove repetitive work from security platform operations.
Python · APIs · Security Engineering · SOARHow it works
A straightforward
assessment process.
Discovery
We map your environment, current challenges, and the assessment scope.
Assessment
I evaluate the agreed components for health, visibility, and operational gaps.
Findings
You receive evidence-backed findings, impact, priority, and recommendations.
Review
We walk through the results and identify the highest-value improvements.
Remediation
If useful, implementation can be scoped as a separate engagement.
About
Security engineering with a platform-first approach.
I’m a Security Engineer with more than five years of experience across Security Operations, SIEM infrastructure, cloud, and security platform engineering.
My work focuses on the systems behind security operations: making sure telemetry is collected correctly, data stays usable, platform components remain healthy, and operational processes can scale.
Explore my GitHub ↗01
SIEM & Platforms
Elastic Security, Kibana, Fleet, Agent, integrations, datastreams, Data Views, ECS.
02
Cloud
AWS security fundamentals, IAM, EC2, S3, Security Groups, CloudTrail, AWS Config.
03
Automation
Python, PowerShell, Bash, REST APIs, and operational security workflows.
FAQ
Before we
get started.
Have a different question? Reach out and tell me about your environment.
Do you need full administrative access?+
Not necessarily. Read-only or limited access can often support significant portions of the review. The exact level depends on scope.
Can the assessment be performed remotely?+
Yes. The service is designed to be delivered remotely, and I can work under NDA.
Do you provide remediation?+
Yes. Remediation and hands-on engineering can be scoped separately after the assessment.
Is this a penetration test?+
No. The Health Check focuses on SIEM platform health, visibility, configuration, architecture, and operations.
Can you review only one part of Elastic?+
Yes. The scope can focus on Fleet, Agents, integrations, ingestion, datastreams, Data Views, lifecycle management, or operations.
Start with visibility
Do you know what your
SIEM isn’t showing you?
Get an independent technical review of your Elastic Security environment and identify gaps before they become operational problems.
Remote engagements · NDA available · Fixed-scope assessments