Contractor gets a working SIEM across two firewall brands, cloud and job-site WiFi with no analyst
A regional commercial general contractor. Outcome verified
The problem
A regional commercial general contractor had firewalls, WiFi controllers, cloud services and email security all generating logs, but no single place to see suspicious activity across them, and a recent phishing incident had made the blind spot concrete. The SIEM vendor's connectors could not collect several key log sources, one network console could not forward logs securely, and a small IT team would run the result with no analysts.
Why it mattered
Without correlation, risky sign-ins and mailbox tampering after a phish could run unnoticed, and because SIEM pricing scales with volume, forwarding everything would spend the budget on noise.
What we did
Vizius wrote a small piece of cloud middleware to handle the authentication the connectors lacked, built custom parsers for the network gear, and cut noise at the source by turning off low-value firewall logs. Detection rules were modeled on the real phishing incident, and the hand-off was a runbook for daily checks.
What changed
By January 2026 every core feed was live, spanning directory, endpoint, cloud, both firewall brands and email security, with more than ten custom detection signals and administrators trained on live alerts. One vendor console could not be ingested and was worked around.
- Construction and engineering
- Midsize company