Building a SOC on a Nigerian budget

You do not need a seven-figure SIEM licence to get real detection coverage. Start here.

Most security programmes in mid-sized Nigerian firms fail for the same reason: they buy tooling before they define detections.

Start with an asset inventory and the ten attack techniques most likely to touch your environment. Map each to a log source you already have. In practice this is Windows event logs, firewall logs, and your identity provider.

Only then choose a platform. Open-source Elastic will carry you a long way at this stage, and the discipline of writing your own detection rules is the training your team actually needs.

The best SOCs we've studied ran for their first months on a small analyst team, a rules repository in Git, and a weekly purple-team hour.