Next-Gen SIEM Health Check.
What is silent, noisy or idle.
A no-cost assessment of the CrowdStrike Falcon® Next-Gen SIEM you already own. A Vijilan solutions engineer finds what is silent, noisy or idle, and gives your team a written plan to fix it.
No purchase order and no obligation. The report is yours to keep.
Your team's time to start, in one online session.
Nothing to grant, install or change to begin.
From the session to your written brief.
Led by a Vijilan solutions engineer. We sign your mutual NDA, or supply ours. Your choice.
A close look at your Next-Gen SIEM.
No charge, no obligation.
We take a close look at your Next-Gen SIEM and give your team a written set of recommendations. It starts with one 90-minute online session. If your team is comfortable after that, a second step looks at how logs arrive, what workflows exist, and what it would take to make your tickets fewer and more actionable. You decide how far to go, and you can stop at any point.
Who it is for: teams that run CrowdStrike Falcon Next-Gen SIEM and want to know whether it is delivering. It fits one instance or several, with or without Falcon Complete, run in-house or with a provider.
It costs nothing.
No purchase order, no budget approval, no procurement cycle.
It starts with a conversation.
No access, no installs, no changes to any instance.
You stay in control.
Every step ends at a point where you decide whether to continue.
You keep everything.
The recommendations are written so your own engineers can act on them, with or without us.
It respects what you have.
We work with your CrowdStrike tenant and alongside Falcon Complete, never in place of it.
It is built around your reality.
If each business unit runs its own instance with its own needs, we assess them that way, then give you one portfolio view.
Step 1: a guided session.
90 minutes, online.
Bring the people who work in the SIEM day to day. Our engineer asks, listens and takes notes. Nothing is changed and no system is accessed.
| Time | Topic | What we cover |
|---|---|---|
| 0–10 min | Goals | Who is in the room, what is working, and what "better" would look like to you |
| 10–30 min | Architecture | Instances, CIDs and parent-child setup, licensed modules, who administers what |
| 30–50 min | Data | Sources onboarded, collection health, parsing gaps, silent sources |
| 50–70 min | Detections and tickets | Where alerts come from, which ones are noise, how tickets flow between Falcon and your ticketing platform, Fusion workflows in use |
| 70–85 min | Falcon Complete | Where its scope ends, which detections nobody owns today, how your team and theirs hand off |
| 85–90 min | Next step | Agree whether Step 2 makes sense and who should be involved |
You receive a written findings and recommendations brief covering everything listed below under "What your team receives."
Step 2: log and workflow review (optional)
Only if your team feels comfortable after Step 1. Scope is agreed with you in writing before it starts. We look at how the SIEM behaves in practice:
- Log ingestion: which sources are reporting, which have gone quiet, where parsers are failing, and where volume is being spent
- Detections: which rules fire, which never do, and which produce the most repetitive alerts
- Workflows: the Fusion SOAR workflows that exist, the ones that are missing, and where automation could close known noise
- Tickets: how detections become tickets, where the two systems fall out of step, and what is sitting in New status
- Modules: what is licensed compared with what is enabled and tuned
You receive a ranked noise-reduction plan. Each item states the change, the expected effect on ticket volume, the effort, and whether your team or ours is best placed to do it.
Three ways to run it.
Move up a level, or stay where you are.
A. Talk it through
Step 1 as a conversation. Your engineer describes the environment from memory and documentation.
What you share
Nothing beyond the conversation
Best when
You want to meet us first and judge the value
B. Your engineer drives
Step 1 with your SIEM engineer sharing their screen. We ask to see a dashboard, a rule or a workflow, and they decide what to open.
What you share
Only what your engineer chooses to show
Best when
You want specifics without granting access
C. Read-only review
Step 2. You create a read-only role for us. We review ingestion, detections, workflows and tickets directly.
What you share
Read-only access, scoped and revocable
Best when
Your engineers are comfortable and want the fullest picture
What your team receives.
Within five business days.
Module scorecard
Which purchased capabilities are enabled, tuned and delivering value, and which are idle
Data source health
Sources that are healthy, silent or failing to parse, with likely causes
Noise map
The detections and sources generating the most repetitive alerts, and which can be tuned or auto-closed safely
Detection gaps
Where telemetry arrives but no rule fires, with identity and account takeover use cases reviewed first
Workflow and ticket review
How alerts become tickets today, where they fall out of step, and what to automate
Falcon Complete boundary
Which detections fall outside its scope and need an owner
Quick wins
Changes your team can make in days, listed first
Portfolio view
One comparison across your instances, so leadership sees a single picture of risk without removing any business unit's independence
The brief is delivered within five business days of the session. A short read-out call walks your team through it.
What we ask you to prepare
A one-page pre-read comes from us once the session is booked. Having these to hand makes the session far more useful:
- The list of instances and the business unit behind each
- Licensed modules, and which are enabled today
- Main data sources, and approximate daily ingest if known
- Your ticketing platform, and how Falcon connects to it
- Who administers each instance, and who triages alerts
- What Falcon Complete covers for you today
- The alerts or tickets that frustrate your team most
- Roughly how many detections are sitting in New status, if you can see it
Gaps are fine. Finding them is the point.
How we handle access and data
- Mutual NDA first. Nothing is shared until it is signed. We sign yours, or supply ours.
- Step 1 needs no access.
- Step 2 is read-only. You create the role, issue named accounts with MFA, and can revoke them at any time.
- We change nothing. No rule, workflow, parser or setting is modified during an assessment.
- Every session is visible. Your team sees what we see, and we record what we looked at.
- Access ends when the assessment ends.
Working with Falcon Complete
Falcon Complete keeps the incidents in its scope. We look at everything around it: data sources, content, workflows and the detections it does not handle. If helpful, we will speak with their team to confirm where scopes meet. We do not duplicate what they do.
What happens afterward
At the read-out you will have a clear picture and a list of changes. Some your team will make itself. If you would like Vijilan to help with any of it, we will propose that separately, based on what the assessment found, and only if you ask. If you do not, the report remains yours and the conversation ends there.
Request your Health Check.
- 1You: Request a Health Check. Tell us which instance or business unit to start with, and who should join.
- 2You: Send your mutual NDA, or ask us to send ours.
- 3Both: Book the 90-minute session.
- 4Vijilan: Send the one-page pre-read.
- 5Vijilan: Run the session and deliver the brief.
- 6Both: Hold the read-out and decide on Step 2.
Other business units can have their own session whenever they like. Each is the same offer.
Questions, answered
Does the Health Check really cost nothing?
Yes. There is no charge and no obligation, and the report is yours to keep. It is one Health Check per organization; each business unit with its own instance can request its own session.
Do you need access to our SIEM?
Not to start. Step 1 is a conversation. Step 2 is optional and uses a read-only role that you create and can revoke at any time.
Do you change anything in our instance?
No. No rule, workflow, parser or setting is modified during an assessment.
Does this replace Falcon Complete?
No. We work alongside it. We look at the data sources, content, workflows and detections around its scope.
How long until we get the findings?
The written brief is delivered within five business days of the 90-minute session, followed by a short read-out call with your team.
Vijilan Security is a managed cybersecurity provider with a 24/7 SOC. NextDefend™ is our managed service for CrowdStrike Falcon Next-Gen SIEM. We are a CrowdStrike Powered Service Provider (CPSP), a partner program designation. We work in English, Spanish and Portuguese.