FortiSIEM Log Review & Tuning

@ibrahim0135

Hello, I can optimize your FortiSIEM deployment to focus on intrusion attempts, unauthorized access, and malware events while reducing noise. My approach includes log review and gap analysis, correlation rule tuning, parser improvements, and validation with fresh log samples. I will ensure accurate field extraction, lower false positives, and preserve all critical detections. Deliverables will include tuned policies with before/after metrics, updated correlation rules, working parsers, and clear rollback documentation. Timeline: 5–7 days depending on log volume and current configuration. I’m ready to start with the initial log sample review.

@vicosurge06

Hello there, hope you are having a fantastic day so far! FortiSIEM tuning is daily work for me, so your scope reads like a checklist I have run many times: pull a representative log sample, hand you a gap analysis that separates the real intrusion, unauthorized access and malware signal from the noise, then implement and validate inside FortiSIEM rather than just advising. Concretely I would: - Review current alert policies and rules, flagging the noisy ones with before and after counts. - Write or fix correlation rules for the three event classes you care about, exported as XML and GUI. - Build or repair parsers and regexes so every useful field is extracted, with test logs and screenshots proving the field mapping. - Leave you a one page hand-off so you can roll back or extend anything I touch. I work against fresh traffic, so you see real validation, not assumptions. Happy to start with the sample log analysis as a small first milestone so you can judge the quality before we commit to the full tuning pass. VR, Vicente Muñoz

@walidk17

Dear Hiring Manager, I am applying for the FortiSIEM Detection Engineering and Log Optimization project. I am a Cybersecurity / SOC Engineer with hands-on experience in SIEM operations, log analysis, and detection engineering. I have worked with FortiSIEM, FortiGate, FortiAnalyzer, Windows Event Logs, Active Directory, VPN, and EDR/AV solutions in enterprise environments. My experience includes onboarding and normalizing log sources, tuning parsers using regex-based field extraction, and building correlation rules aligned with MITRE ATT&CK. I regularly work on reducing false positives while ensuring critical threats such as intrusion attempts, unauthorized access, and malware activity are properly detected. I have developed and tuned detection use cases for brute force attacks, password spraying, VPN anomalies, lateral movement, internal scanning, and malware outbreaks. I also validate detections using real log traffic and controlled simulation to ensure accuracy and coverage. My approach follows a structured lifecycle: log review, gap analysis, rule and parser optimization, validation, and documentation with rollback procedures. I focus on improving signal-to-noise ratio while ensuring no critical security event is missed. I would be glad to contribute to optimizing your FortiSIEM environment and improving detection quality and operational efficiency. Kind regards, Walid Kamal