EmberSec

Fixed-scope packages.

From a security architect and engineer: defined work at a fixed price, so you know what you're getting before you commit. Prices below are typical ranges in NZD, excluding GST. The written quote after a scoping call is the price.

This is a planning page. Packages open in 2027 and I'm not taking on new work yet. If you'd like to talk about timing, email jonathan@embersec.nz.

Design

Sentinel architecture review

$2,500 to $4,500NZD, excl. GST

A written review of how your Microsoft Sentinel environment is laid out and where it should go: workspace and tenant design, ingestion and cost, retention, access, and data connectors. It finishes with a prioritised roadmap for detections and automation.

I need
Read access to your workspace, and a couple of hours with the people who own the environment.
Time
2 to 3 weeks.
Not included
Implementing the recommendations. I can quote that separately.

Log pipeline design

$1,500 to $3,000NZD, excl. GST

A written design for how logs get from your sources to your SIEM. I use your network topology to plan the routes, collectors, parsing, retention and failure handling, with a diagram your team can build from.

I need
A sanitised network diagram or topology summary, a list of the log sources, and time with someone who knows the network.
Time
1 to 3 weeks.
Not included
Building it. I can quote that separately.

Build and tune

Visibility query

from $300NZD, excl. GST

One KQL query and a workbook graph for a metric you want visibility on, with a short note on how it works and how to change it. For example: ingestion volume by source, failed sign-ins over time, or alert volume by rule.

I need
Read access to your workspace, and the question you want answered.
Time
About 3 to 5 working days.
Not included
A full set of dashboards.

Log ingestion review

$600 to $900NZD, excl. GST

A written review of what's flowing into your workspace, what's missing, and what's noisy or costing you money, with a prioritised list of fixes.

I need
Read access to your workspace, and an hour with someone who knows the environment.
Time
About a week.
Not included
Making the fixes. I can quote that separately.

Detection pack

$1,000 to $1,500for 5 rules, NZD excl. GST

$1,800 to $3,000for 10 rules, NZD excl. GST

Custom analytic rules written for the log sources you actually have, mapped to MITRE ATT&CK and tested against your data. Each rule comes with a short runbook and tuning notes, delivered as deployable rule templates.

I need
Read access to your workspace, a list of the threats you care about most, and a way to deploy the rules. Your team can deploy them, or I can if you grant rule-level access.
Time
2 to 4 weeks, depending on how many rules.
Not included
Ongoing tuning. See the tuning sprint.

Tuning sprint

$1,800 to $3,000NZD, excl. GST

Your noisiest analytic rules, reviewed over 30 days. You get the changes made or recommended, before and after alert volumes, and written tuning notes so your team can repeat the approach on other rules.

I need
Read access to your workspace and alert history, and a way to apply the changes. Your team can apply them, or I can if you grant rule-level access.
Time
30 days.
Not included
New detections. See the detection pack.

Log source parser

$600 to $1,200NZD, excl. GST

A Logstash pipeline for one log source that your SIEM doesn't parse well, with test cases built from your sample logs and short documentation.

I need
Sanitised sample logs, and the field names you want in your SIEM.
Time
1 to 2 weeks.
Not included
Deploying it to your servers. I can quote that separately.

Ongoing work

By quotehourly or retainer

Architecture, automation, integrations and SIEM engineering over a longer period: design work, Azure Logic Apps, custom REST API endpoints, and detection and parser work as it comes up.

I need
A list of the work and who I'll be working with.
Time
Agreed up front.

What I don't do: 24/7 monitoring, incident response, or work that needs administrator access to your environment. Access is always read-only or limited to what the job needs, and it's removed when we finish.

How buying will work

  1. A free scoping call

    About 20 minutes. I check your log sources, licensing and setup, and we agree what the package would cover for you.

  2. A written fixed price

    You get a short written scope and price. A 50% deposit starts the work.

  3. Delivery and review

    I deliver, you review, and the balance is due when you're happy the scope has been met.

Every quote comes with a one-page scope and terms sheet.

Interested?

Packages open in 2027. To talk about timing, or what you'd need for your environment, email jonathan@embersec.nz.