Back to layer 1
Layer 01
Identity, Endpoint, Network, and Cloud
This layer establishes the telemetry foundation for security operations. It makes the core sources visible, governed, and ready for threat-informed detection, AI-assisted investigation, response, and reporting work.
Vendor products
- FortiSIEM
- FortiEDR
- FortiRecon
- Splunk
- Securonix
- Google SIEM
Munio services
- Security architecture
- Source onboarding
- Visibility gap review
- AI-ready telemetry review
- Threat intelligence source review
- Licensing alignment
Delivery shape
- Confirm priority business systems, security sources, and coverage gaps.
- Define onboarding order, ownership, retention, and platform constraints.
- Validate that telemetry is usable before threat-informed detection engineering and AI-assisted investigation begins.