Alert fatigue isn't a SIEM problem. It's a detection problem.
Detection engineering for mid-size teams running Microsoft Sentinel and Azure.
The obvious version of this detection fires every time a software installer runs. This one is aimed at where the value points, not at the mechanism.
Services
Start with an assessment. Fixed scope, dated, and it tells you what to fix before anyone commits to a bigger engagement.
Detection Gap Assessment
A coverage review mapped to MITRE ATT&CK: where you're blind, where you're noisy, and what to build first. You get the gap, at the resolution your data honestly supports, and a build order.
Sentinel Cost Optimization Assessment
Fixed-scope review of your Sentinel ingestion: DCR transforms, table tiering, and ingesting only the fields you actually query. We find the wasted spend and hand you a plan to cut it. The fee credits toward the remediation work if you want us to do it.
- Detection Library BuildoutsProduction detections built and tuned in a live lab, mapped to ATT&CK, shipped as code.
- Detection-as-a-ServiceOngoing detection engineering on a subscription: new detections, tuning, and coverage that keeps pace with your environment.
- SIEM / EDR TuningCut false positives on the tooling you already own, so your team acts on alerts instead of ignoring them.
- Purple Team ExercisesSimulated adversary activity to prove your detections fire before a real attacker tests them for you.
Built for Microsoft Sentinel, Azure and Defender. The method travels, so we work in Splunk, Elastic and CrowdStrike when a client needs it.
Our Approach
We don't deliver generic rule packs. Every engagement starts with understanding your environment, your adversaries, and your team's real capabilities.
Threat Model Alignment
Before we write a single detection, we map your environment's attack surface: who's targeting your industry, how they get in, and what they go after. That's what shapes everything we build.
Coverage Gap Analysis
We map your existing detections against MITRE ATT&CK and your threat model to produce a gap report with clear prioritization.
Detect, Test, Deploy
Every rule we write is tested against real attack simulation before it hits production. No untested detections.
Maintain & Iterate
Threats evolve. We keep your detections current, retire stale rules, and continuously validate coverage as your environment changes.
Want to build these skills in-house? The Adversary Lab is Purple Shell's detection engineering training program: the exact methodology above, taught to practitioners. Same standards we deploy for clients.
See the program →Don't take my word for it. Read the code.
The top of this page says alert fatigue is a detection problem. Here's me solving it in the open: detections shipped as code, SentinelHealthCheck, and an evidence-first triage agent. No client logos to parade yet, so instead of a pitch, here's the actual work.
Sentinel Detection Pipeline
Detection-as-code for Microsoft Sentinel. Rules are authored in YAML, peer-reviewed in a pull request, schema-validated, and compiled to Bicep, then deployed to Sentinel by GitHub Actions about a minute after they merge. Full version history, audit trail, and rollback.
View on GitHub →Sentinel Health Check
One read-only PowerShell command grades your Sentinel workspace in under five minutes and hands back an HTML report card. It flags disabled and erroring rules, dead data sources, noisy detections, and coverage gaps. It reads your workspace. It never changes it.
GuardDuty Triage Agent
A read-only AI agent that triages GuardDuty findings. Triggered by EventBridge, a Lambda pulls CloudTrail, VPC flow logs, and IP enrichment for context, reasons on Bedrock, and drops a schema-validated verdict on an SQS queue for your SIEM. It never touches your account. It advises, a human acts.
View on GitHub →
Built by a Principal Detection Engineer. For teams that need it done right.
I've watched organizations spend millions on security tools and still get breached. Not because the tools failed. Because nobody built the right detections.
That's the gap I fill.
I'm Charles Garrett. Years spent in financial services environments where the adversaries are sophisticated, the data is sensitive, and getting it wrong isn't an option. Cloud-native. Multi-platform. Every detection tested against attack simulation before it ships.
That's what you get with Purple Shell Security.
Let's Talk
If your team is drowning in alerts or you're not confident your detections would catch the threats targeting you, that's where we start. Tell us what you're dealing with. We'll tell you what we can do about it.
Or email Charles directly at
charles@purpleshellsecurity.com
Response time: within one business day.
Every engagement starts with a fixed-fee Detection Gap Assessment: a prioritized coverage report mapped to MITRE ATT&CK and the threats targeting you. No long-term commitment to see the value. Ongoing work is month-to-month.